Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-7228

Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.

Published

2014-11-03T22:55:08.413

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-310
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application joomla joomla\! 2.5.4 Yes
Application joomla joomla\! 2.5.5 Yes
Application joomla joomla\! 2.5.6 Yes
Application joomla joomla\! 2.5.7 Yes
Application joomla joomla\! 2.5.8 Yes
Application joomla joomla\! 2.5.9 Yes
Application joomla joomla\! 2.5.10 Yes
Application joomla joomla\! 2.5.11 Yes
Application joomla joomla\! 2.5.12 Yes
Application joomla joomla\! 2.5.13 Yes
Application joomla joomla\! 2.5.14 Yes
Application joomla joomla\! 2.5.15 Yes
Application joomla joomla\! 2.5.16 Yes
Application joomla joomla\! 2.5.17 Yes
Application joomla joomla\! 2.5.18 Yes
Application joomla joomla\! 2.5.19 Yes
Application joomla joomla\! 2.5.20 Yes
Application joomla joomla\! 2.5.21 Yes
Application joomla joomla\! 2.5.22 Yes
Application joomla joomla\! 2.5.23 Yes
Application joomla joomla\! 2.5.24 Yes
Application joomla joomla\! 2.5.25 Yes
Application joomla joomla\! 3.0.0 Yes
Application joomla joomla\! 3.0.1 Yes
Application joomla joomla\! 3.0.2 Yes
Application joomla joomla\! 3.0.3 Yes
Application joomla joomla\! 3.0.4 Yes
Application joomla joomla\! 3.1.0 Yes
Application joomla joomla\! 3.1.1 Yes
Application joomla joomla\! 3.1.2 Yes
Application joomla joomla\! 3.1.3 Yes
Application joomla joomla\! 3.1.4 Yes
Application joomla joomla\! 3.1.5 Yes
Application joomla joomla\! 3.1.6 Yes
Application joomla joomla\! 3.2.0 Yes
Application joomla joomla\! 3.2.1 Yes
Application joomla joomla\! 3.2.2 Yes
Application joomla joomla\! 3.2.3 Yes
Application joomla joomla\! 3.2.4 Yes
Application joomla joomla\! 3.2.5 Yes
Application joomla joomla\! 3.3.0 Yes
Application joomla joomla\! 3.3.1 Yes
Application joomla joomla\! 3.3.2 Yes
Application joomla joomla\! 3.3.3 Yes
Application joomla joomla\! 3.3.4 Yes
References