Fabrik vulnerabilities

The Joomla extension Fabrik before version 4.7.2 contains a heredoc terminator breakout vulnerability in the calc element. Additionally, the onUpdateComment endpoint did not perform any access checks.

Joomla extension Fabrik before 4.7.2 has a missing ACL check in the download element, potentially allowing unauthorized file access.

Joomla extension Fabrik before 4.7.2 is vulnerable to Path Traversal via the image element, potentially allowing access to files outside the application directory.

Joomla extension Fabrik before 4.7.2 allows remote code execution via the image element.

Joomla extension Fabrik before 4.7.2 has an unauthenticated remote code execution vulnerability via the PHP form element, which executes user-provided code.

Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in ORDER BY, as the order parameter in list models is used in queries without validation, allowing read SQLi vectors.

Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in the list filter condition parameter, as the condition parameter is concatenated verbatim into the WHERE clause built by getFilterQuery(), allowing full database read.

The Joomla extension Fabrik before version 4.6.8 has an unauthenticated remote code execution vulnerability. An attacker can execute arbitrary code by using the frontend listfilter model.

The Joomla extension Fabrik before version 4.7.2 contains a remote code execution vulnerability. An unauthenticated attacker can execute arbitrary code by using the ajax_calc feature of the calc plugin.

The Joomla extension Fabrik before version 4.7.2 contains an unauthenticated stored XSS vulnerability. The handling of user-supplied input in the jsactions feature leads to a stored XSS vector.

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated disclosure of commenters' email addresses. The onGetEmail endpoint does not perform any access checks.

The Joomla extension Fabrik before version 4.7.2 has a vulnerability due to missing access controls in the form.inlineedit controller, allowing unauthenticated users to read form data.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated row reordering. The order plugin does not perform any access checks.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated deletion of any comment. The DeleteComment endpoint does not perform any access checks.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to disclose the list of database tables and the table prefix. The ajax_tables method of the elements model permits listing arbitrary database tables including their columns.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to list arbitrary directories on the server. The onAjax_getFolders method of the elements model permits arbitrary directory listings.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to upload arbitrary non-executable files to the web root. The vulnerability is in the list email plugin controller.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to truncate the target list's table. The list.doempty endpoint lacks ACL gates, and a plain GET empties the table.