CVE-2019-25761
HIGHJoomla! Component JoomCRM 1.1.1 SQL Injection via deal_id
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25761. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in Joomla! Component JoomCRM 1.1.1 via the 'deal_id' and 'association_id' parameters. The payload uses URL-encoded SQL syntax to extract database information, confirming the vulnerability.
Description
Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and schemas.
Exploits (1)
The exploit demonstrates a SQL injection vulnerability in Joomla! Component JoomCRM 1.1.1 via the 'deal_id' and 'association_id' parameters. The payload uses URL-encoded SQL syntax to extract database information, confirming the vulnerability.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N