Dj Classifieds Extension For Joomla
Monthly
Unauthenticated SQL injection in the frontend search of the DJ-Classifieds extension for Joomla (versions before 3.11.3) lets remote attackers reach the site's database without logging in, with high confidentiality, integrity and availability impact (CVSS 9.3, CWE-89). Affected are Joomla sites running the third-party classifieds component from dj-extensions.com; exploitation requires only that the extension be installed and its frontend search be publicly reachable, which is the normal deployment mode for an anonymous-visitor listings component. No CISA KEV entry exists and no public exploit identified at time of analysis, but the vendor-reported severity and the lack of any authentication or interaction prerequisite make this an act_now priority.
Authenticated arbitrary file upload in the DJ-Classifieds extension for Joomla before 3.11.3 lets a low-privileged account (PR:L) place files of a dangerous type on the web server and escalate to full remote code execution. The vendor-reported severity is high - CVSS 9.4 as published, with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N and high confidentiality, integrity and availability impact - and the current priority label is act_now, so sites running the component should be updated promptly. No CISA KEV entry and no public exploit code were identified at time of analysis; the exact upload parameter and the validation-bypass technique are not described in the available sources.
DJ-Classifieds before 3.11.3 exposes seller contact details and draft ad content to any logged-in user through an insecure direct object reference in the duplicate-my-ad feature. An authenticated user of any role can supply another advert's small sequential numeric ID to the new-ad form and receive that ad's full content, including phone number, address, email, and price, even if the ad was never published, blocked, or still pending. No public exploit was identified at time of analysis, and the assessed impact is confidentiality-only with a moderate CVSS score of 5.3.
Unauthenticated SQL injection in the frontend search of the DJ-Classifieds extension for Joomla (versions before 3.11.3) lets remote attackers reach the site's database without logging in, with high confidentiality, integrity and availability impact (CVSS 9.3, CWE-89). Affected are Joomla sites running the third-party classifieds component from dj-extensions.com; exploitation requires only that the extension be installed and its frontend search be publicly reachable, which is the normal deployment mode for an anonymous-visitor listings component. No CISA KEV entry exists and no public exploit identified at time of analysis, but the vendor-reported severity and the lack of any authentication or interaction prerequisite make this an act_now priority.
Authenticated arbitrary file upload in the DJ-Classifieds extension for Joomla before 3.11.3 lets a low-privileged account (PR:L) place files of a dangerous type on the web server and escalate to full remote code execution. The vendor-reported severity is high - CVSS 9.4 as published, with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N and high confidentiality, integrity and availability impact - and the current priority label is act_now, so sites running the component should be updated promptly. No CISA KEV entry and no public exploit code were identified at time of analysis; the exact upload parameter and the validation-bypass technique are not described in the available sources.
DJ-Classifieds before 3.11.3 exposes seller contact details and draft ad content to any logged-in user through an insecure direct object reference in the duplicate-my-ad feature. An authenticated user of any role can supply another advert's small sequential numeric ID to the new-ad form and receive that ad's full content, including phone number, address, email, and price, even if the ad was never published, blocked, or still pending. No public exploit was identified at time of analysis, and the assessed impact is confidentiality-only with a moderate CVSS score of 5.3.