CVE-2020-37218
HIGHJoomla com_hdwplayer 4.2 SQL Injection via search.php
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37218. PoCs published by qw3rTyTy.
AI-analyzed exploit summary The exploit details a SQL injection vulnerability in Joomla! com_hdwplayer 4.2, specifically in the 'search.php' file where user input is directly interpolated into a SQL query without sanitization. The PoC uses sqlmap to demonstrate the vulnerability, but the core of the submission is a technical analysis of the vulnerable code.
Description
Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL payloads in the hdwplayersearch parameter to extract sensitive database information from the hdwplayer_videos table.
Exploits (1)
The exploit details a SQL injection vulnerability in Joomla! com_hdwplayer 4.2, specifically in the 'search.php' file where user input is directly interpolated into a SQL query without sanitization. The PoC uses sqlmap to demonstrate the vulnerability, but the core of the submission is a technical analysis of the vulnerable code.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N