SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

According to its self-reported version number, the detected Joomla! application is affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input.

An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or modification of arbitrary data.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Joomla! installation running on the remote web server is affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or modification of arbitrary data.

According to its self-reported version number, the Joomla! installation running on the remote web server is 3.7.x prior to 3.7.1.
It is, therefore, affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input.
An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or modification of arbitrary data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

JSST reports :

Inadequate filtering of request data leads to a SQL Injection vulnerability.

ID	Name	Product	Family	Severity
98425	Joomla! 3.7.x < 3.7.1 fields.php getListQuery() Method SQLi	Web App Scanning	Component Vulnerability	critical
98218	Joomla! 3.7.0 < 3.7.1 fields.php getListQuery() Method SQLi	Web App Scanning	Component Vulnerability	critical
100385	Joomla! 3.7.x < 3.7.1 fields.php getListQuery() Method SQLi	Nessus	CGI abuses	critical
100282	FreeBSD : Joomla3 -- SQL Injection (3c2549b3-3bed-11e7-a9f0-a4badb296695)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-8917

critical

Tenable Plugins

critical

critical

critical

critical