Description

The Kunena forum extension for Joomla suffers from multiple SQL injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. The vulnerabilities affect Kunena v3.0.5 and earlier.

Remediation

Upgrade to the latest version of Kunena Forum (this problems was fixed in version 3.0.6).

References

Kunena Forum for Joomla Multiple Vulnerabilities

Kunena 3.0.6 Released

Related Vulnerabilities

Joomla! 1.6/1.7/2.5 privilege escalation vulnerability

WordPress Plugin Quote-O-Matic SQL Injection (1.0.5)

WordPress Plugin Instant Images-One Click Unsplash Uploads Cross-Site Scripting (4.4.0)

WordPress Plugin WP Yelp Review Slider SQL Injection (7.0)

WordPress Plugin Funnel Builder by CartFlows-Create High Converting Sales Funnels For WordPress Cross-Site Scripting (1.6.12)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

SQL Injection XSS CWE-89 CVE-2014-9102 CVE-2014-9103