CVE-2010-1720

EPSS 1.2%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 1.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

13 Apr 2010Public PoC

04 May 2010Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

SQL injection vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the katid parameter in a qpListele action to index.php.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/12200unverified exploitdbwww.exploit-db.com/exploits/12723unverified exploitdbwww.exploit-db.com/exploits/12200unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/63894 http://secunia.com/advisories/39445 https://exchange.xforce.ibmcloud.com/vulnerabilities/57775 http://www.exploit-db.com/exploits/12200 http://www.securityfocus.com/bid/39466 http://www.xenuser.org/documents/security/qpersonel_sql.txt