CVE-2022-23797

[20220305] - Core - Inadequate filtering on the selected Ids

published March 30, 2022

CVSS
—
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

⚠️ A tiny gap in filtering could lead to a SQL injection in Joomla! — think of it like a misprinted coupon that lets you buy a fancy dinner without paying! Consider an order form at a restaurant where the waiter doesn’t check what’s written down. If someone slips in a request for a free meal without verification, they’d walk out with a full belly! An attacker could exploit this SQL injection possibility to manipulate the database, potentially gaining unauthorized access to sensitive data or altering records. Imagine an uninvited guest sneaking into the kitchen and changing your dinner order — it could lead to chaos and loss of valuable information!

Put simply

Consider an order form at a restaurant where the waiter doesn’t check what’s written down. If someone slips in a request for a free meal without verification, they’d walk out with a full belly! This vulnerability arises due to inadequate filtering on selected IDs in requests, which allows an attacker to inject malicious SQL queries into the database, impacting its integrity and security.

What to do

An attacker could exploit this SQL injection possibility to manipulate the database, potentially gaining unauthorized access to sensitive data or altering records. Imagine an uninvited guest sneaking into the kitchen and changing your dinner order — it could lead to chaos and loss of valuable information! To safeguard your Joomla! site, upgrade to at least version 4.1.1 or apply a patch if available. Additionally, review all input validation processes to ensure no dodgy requests slip through. Your database is your castle — protect it! You've got this! Strengthen your defenses and keep your website safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01106 · 65.5th percentile
Published
2022-03-30T15:20Z
EPSS history
Timeline
  • 30 MAR 15:20Z
    [20220305] - Core - Inadequate filtering on the selected Ids
    cvelistv5