CVE-2017-20262
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Ajax Quiz component version 1.8 for Joomla! contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter.
Risk Assessment
Attackers can access sensitive database information, including table names and column structures, which may lead to further attacks on the system.
Recommendation
It is recommended to update the Ajax Quiz component to the latest version to mitigate this vulnerability and to monitor server logs for potential attack attempts.
Original NVD description (English source)
Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=com_ajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.