Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Joomla Cryptographic Issues Vulnerability - CVE-2014-7228 - Vulnerability Database
Joomla

Joomla Cryptographic Issues Vulnerability - CVE-2014-7228

High
Reference: CVE-2014-7228
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2014-7228
Title: Joomla Cryptographic Issues Vulnerability
Overview:

Akeeba Restore (restore.php) as used in Joomla 2.5.4 through 2.5.25 3.x through 3.2.5 and 3.3.0 through 3.3.4 Akeeba Backup for Joomla Professional 3.0.0 through 4.0.2 Backup Professional for WordPress 1.0.b1 through 1.1.3 Solo 1.0.b1 through 1.1.2 Admin Tools Core and Professional 2.0.0 through 2.4.4 and CMS Update 1.0.a1 through 1.0.1 when performing a backup or update for an archive does not delete parameters from _GET and _POST when it is cleansing _REQUEST but later accesses _GET and _POST using the getQueryParam function which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.