Custom Tables extension for Joomla allows unauthenticated file upload
Anyone can upload files through a Joomla site's data entry extension!
Summary
The Custom Tables extension for Joomla lets an unauthenticated attacker upload files to the site. Uploaded files can be used to host phishing or malware pages under the victim's domain.
Affected when
- Joomla site exposing a public Custom Tables submission form
What to do
Check that the extension runs a version newer than 3.7.7, and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen