CVE-2014-4960

Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2014-07-21

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Com Youtubegallery (Joomlaboat)

References

• http://packetstormsecurity.com/files/127497/Joomla-Youtube-Gallery-4.1.7-SQL-Injection.html
• http://www.exploit-db.com/exploits/34087
• http://www.securityfocus.com/bid/68676