Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Visforms Base Package for Joomla 3 by vi-solutions
CVE-2023-23753 (GCVE-0-2023-23753)
Vulnerability from nvd – Published: 2023-04-23 20:33 – Updated: 2025-02-06 10:48
VLAI
EPSS
VEX
Title
Extension - vi-solutions - Visforms Base Package for Joomla 3
Summary
The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- SQL Injection
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://vi-solutions.de/en/announcements/867-secu… | vendor-advisory |
| https://blog.asturhackers.es/sql-injection-en-vis… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vi-solutions | Visforms Base Package for Joomla 3 |
Affected:
3.0.4
Unaffected: 3.0.5 |
Date Public
2023-04-24 18:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:42:25.788Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://vi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-23753",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T15:44:46.766910Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T15:45:10.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Visforms Base Package for Joomla 3",
"vendor": "vi-solutions",
"versions": [
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "unaffected",
"version": "3.0.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David \u00c1lvarez, Francisco D\u00edaz-Pache and Sergio Corral from Grupo CIES - AliSEC and Kevin Barb\u00f3n"
}
],
"datePublic": "2023-04-24T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe \u0027Visforms Base Package for Joomla 3\u0027 extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.\u003c/p\u003e"
}
],
"value": "The \u0027Visforms Base Package for Joomla 3\u0027 extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can interact with the database and could be able to read, modify and delete data on it."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SQL Injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T10:48:25.140Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://vi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Extension - vi-solutions - Visforms Base Package for Joomla 3",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2023-23753",
"datePublished": "2023-04-23T20:33:51.958Z",
"dateReserved": "2023-01-17T19:02:50.302Z",
"dateUpdated": "2025-02-06T10:48:25.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23753 (GCVE-0-2023-23753)
Vulnerability from cvelistv5 – Published: 2023-04-23 20:33 – Updated: 2025-02-06 10:48
VLAI
EPSS
VEX
Title
Extension - vi-solutions - Visforms Base Package for Joomla 3
Summary
The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- SQL Injection
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://vi-solutions.de/en/announcements/867-secu… | vendor-advisory |
| https://blog.asturhackers.es/sql-injection-en-vis… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vi-solutions | Visforms Base Package for Joomla 3 |
Affected:
3.0.4
Unaffected: 3.0.5 |
Date Public
2023-04-24 18:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:42:25.788Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://vi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-23753",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T15:44:46.766910Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T15:45:10.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Visforms Base Package for Joomla 3",
"vendor": "vi-solutions",
"versions": [
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "unaffected",
"version": "3.0.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David \u00c1lvarez, Francisco D\u00edaz-Pache and Sergio Corral from Grupo CIES - AliSEC and Kevin Barb\u00f3n"
}
],
"datePublic": "2023-04-24T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe \u0027Visforms Base Package for Joomla 3\u0027 extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.\u003c/p\u003e"
}
],
"value": "The \u0027Visforms Base Package for Joomla 3\u0027 extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can interact with the database and could be able to read, modify and delete data on it."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SQL Injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T10:48:25.140Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://vi-solutions.de/en/announcements/867-security-announcement-cve-2023-23754"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://blog.asturhackers.es/sql-injection-en-visforms-base-package-for-joomla-3-0-5-cve-2023-23753"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Extension - vi-solutions - Visforms Base Package for Joomla 3",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2023-23753",
"datePublished": "2023-04-23T20:33:51.958Z",
"dateReserved": "2023-01-17T19:02:50.302Z",
"dateUpdated": "2025-02-06T10:48:25.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}