Sourcerer Free Extension For Joomla
Monthly
Code injection in Regular Labs Sourcerer before 17.0.1, when used with Articles Anywhere before 20.1.1, allows an authenticated article author to have PHP-bearing Sourcerer content from a low-trust article evaluated under the identity of a more-trusted enclosing article. The vulnerable path requires Articles Anywhere to include that article, inclusion to be processed before Sourcerer, and Force Content Triggers to be off; ordinary Articles Anywhere output is not affected. No confirmed active exploitation or public exploit was identified in the provided intelligence, and updates to Sourcerer 17.0.1 and Articles Anywhere 20.1.1 address the flaw.
Code injection in Regular Labs Sourcerer before 17.0.1, when used with Articles Anywhere before 20.1.1, allows an authenticated article author to have PHP-bearing Sourcerer content from a low-trust article evaluated under the identity of a more-trusted enclosing article. The vulnerable path requires Articles Anywhere to include that article, inclusion to be processed before Sourcerer, and Force Content Triggers to be off; ordinary Articles Anywhere output is not affected. No confirmed active exploitation or public exploit was identified in the provided intelligence, and updates to Sourcerer 17.0.1 and Articles Anywhere 20.1.1 address the flaw.