CVE Vulnerabilities

CVE-2014-7228

Published: Nov 03, 2014 | Modified: May 09, 2016
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.

Affected Software

Name Vendor Start Version End Version
Joomla! Joomla 2.5.19 2.5.19
Joomla! Joomla 2.5.7 2.5.7
Joomla! Joomla 2.5.17 2.5.17
Joomla! Joomla 3.1.4 3.1.4
Joomla! Joomla 3.1.3 3.1.3
Joomla! Joomla 3.3.3 3.3.3
Joomla! Joomla 2.5.25 2.5.25
Joomla! Joomla 3.2.1 3.2.1
Joomla! Joomla 2.5.22 2.5.22
Joomla! Joomla 3.3.4 3.3.4
Joomla! Joomla 2.5.8 2.5.8
Joomla! Joomla 3.1.5 3.1.5
Joomla! Joomla 3.1.1 3.1.1
Joomla! Joomla 3.3.1 3.3.1
Joomla! Joomla 3.2.2 3.2.2
Joomla! Joomla 3.0.2 3.0.2
Joomla! Joomla 2.5.15 2.5.15
Joomla! Joomla 2.5.13 2.5.13
Joomla! Joomla 2.5.11 2.5.11
Joomla! Joomla 2.5.23 2.5.23
Joomla! Joomla 3.0.4 3.0.4
Joomla! Joomla 2.5.21 2.5.21
Joomla! Joomla 3.3.0 3.3.0
Joomla! Joomla 3.1.6 3.1.6
Joomla! Joomla 3.2.4 3.2.4
Joomla! Joomla 2.5.20 2.5.20
Joomla! Joomla 3.0.3 3.0.3
Joomla! Joomla 3.0.1 3.0.1
Joomla! Joomla 2.5.10 2.5.10
Joomla! Joomla 2.5.9 2.5.9
Joomla! Joomla 2.5.4 2.5.4
Joomla! Joomla 2.5.16 2.5.16
Joomla! Joomla 3.2.3 3.2.3
Joomla! Joomla 3.2.0 3.2.0
Joomla! Joomla 2.5.6 2.5.6
Joomla! Joomla 2.5.14 2.5.14
Joomla! Joomla 2.5.12 2.5.12
Joomla! Joomla 3.1.0 3.1.0
Joomla! Joomla 3.3.2 3.3.2
Joomla! Joomla 2.5.5 2.5.5
Joomla! Joomla 2.5.18 2.5.18
Joomla! Joomla 3.2.5 3.2.5
Joomla! Joomla 3.0.0 3.0.0
Joomla! Joomla 3.1.2 3.1.2
Joomla! Joomla 2.5.24 2.5.24

References