CVE-2014-9102

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-26 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php.

Affected products

Kunena: through 3.0.5

References

http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html
http://www.kunena.org/blog/139-kunena-3-0-6-released
http://www.kunena.org/docs/Kunena_3.0.6_Read_Me
http://www.securityfocus.com/bid/68956
http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html
http://www.kunena.org/blog/139-kunena-3-0-6-released
http://www.kunena.org/docs/Kunena_3.0.6_Read_Me
http://www.securityfocus.com/bid/68956

Get alerted when CVE-2014-9102 or the next vulnerability affects your stack