Custom Tables Extension For Joomla
Monthly
Unauthenticated arbitrary file upload in the Joomla Custom Tables extension before 3.7.8 allows an attacker to place a polyglot file with an attacker-controlled extension in the site's web-accessible tmp directory when a public Custom Tables submission form is exposed, and the response discloses the stored path. Because uploaded files are served as static content by default, the assessed impact is integrity only: hosting attacker-controlled content such as phishing or malware pages under the victim domain, not confirmed code execution. No public exploit was identified in the supplied data, and the supplied priority label is act_now.
Unauthenticated arbitrary file upload in the Joomla Custom Tables extension before 3.7.8 allows an attacker to place a polyglot file with an attacker-controlled extension in the site's web-accessible tmp directory when a public Custom Tables submission form is exposed, and the response discloses the stored path. Because uploaded files are served as static content by default, the assessed impact is integrity only: hosting attacker-controlled content such as phishing or malware pages under the victim domain, not confirmed code execution. No public exploit was identified in the supplied data, and the supplied priority label is act_now.