DJ-Classifieds Joomla extension file upload, SQL injection and ad data exposure flaws
The ad board add-on on websites can be broken into, exposing servers and member details!
Summary
The DJ-Classifieds extension for Joomla has arbitrary file upload, SQL injection and cross-account ad access flaws. Versions 1.0 to 3.11.2 are affected; logged-in users and anyone using the frontend search can exploit them.
Affected when
- Joomla site with DJ-Classifieds installed
What to do
Check that you run version 3.11.3 or newer and read the vendor's advisory. Affected versions are 3.11.2 and older.
Products and platforms
CVE IDs
Sources
Times
First published
First seen