CVE-2019-25753
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Joomla! Component VMap version 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter.
Risk Assessment
Attackers can manipulate database queries and extract sensitive information, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update the VMap component to the latest version and implement input data filtering to prevent SQL injection.
Original NVD description (English source)
Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.