CVE-2019-25754
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Joomla Component vRestaurant version 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keysearch parameter. Attackers can send POST requests to the menu-listing-layout endpoint with crafted SQL payloads in the keysearch parameter to extract database table names and sensitive information.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows attackers to access sensitive data in the database, potentially leading to data loss or user privacy breaches.
Recommendation
It is recommended to update the vRestaurant component to the latest version to mitigate this vulnerability and implement appropriate security measures such as input validation.
Original NVD description (English source)
Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keysearch parameter. Attackers can send POST requests to the menu-listing-layout endpoint with crafted SQL payloads in the keysearch parameter to extract database table names and sensitive information from the database.