Zoo vulnerabilities

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64. The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64. The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has a reflected XSS and open redirect vulnerability via the submission redirect parameter.

Joomla Extension - yootheme.com - Zoo prior to version 4.1.66 has unauthenticated stored XSS. User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has an unauthenticated arbitrary directory listing vulnerability via the Gallery element.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has missing CSRF tokens on front-end state changes, enabling CSRF attacks.

In the Zoo extension for Joomla (versions < 4.1.65), the comment controller endpoint lacks ACL checks, allowing unauthenticated users to modify tags without authorization.

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.