CVE-2017-20258
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Joomla! Component RPC Responsive Portfolio version 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.
Risk Assessment
This vulnerability poses a serious risk to data security within the organization, allowing attackers to access confidential information in the database. This could lead to data loss, privacy breaches, and potential financial losses.
Recommendation
It is recommended to update the component to the latest version to eliminate this vulnerability. Additionally, implementing input validation and monitoring system activity is advisable.
Original NVD description (English source)
Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.