Tf Content For Joomla
Monthly
Unauthenticated guests can force execution of any published automation task in TF Content for Joomla versions 2.9.0 through 2.9.4 by supplying a task's numeric ID to the records.custom_action endpoint. The extension lacks authentication, ACL, CSRF, task-trigger, content-binding, and cron-token enforcement, allowing immediate dispatch of the configured executor. No public exploit identified at time of analysis, and the risk is assessed as a genuine but mid-tier priority.
TF Content 2.9.0 through 2.9.4, a Joomla content extension distributed by joomlafry.com, allows unauthenticated remote attackers to create and modify arbitrary TF Content records because its public RecordController performs no authorization check and its shared frontend save controller writes the raw jform array without filtering it through the configured form. By pulling a valid Joomla token from the public login form and supplying an existing record ID, a guest - with no account, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - can mass-assign fields such as published, access, and created_by on any TF Content row. Impact is bounded to low confidentiality, integrity, and availability effects on TF Content data rather than full site compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, placing this as a genuine but moderate-priority issue.
Unauthenticated guests can force execution of any published automation task in TF Content for Joomla versions 2.9.0 through 2.9.4 by supplying a task's numeric ID to the records.custom_action endpoint. The extension lacks authentication, ACL, CSRF, task-trigger, content-binding, and cron-token enforcement, allowing immediate dispatch of the configured executor. No public exploit identified at time of analysis, and the risk is assessed as a genuine but mid-tier priority.
TF Content 2.9.0 through 2.9.4, a Joomla content extension distributed by joomlafry.com, allows unauthenticated remote attackers to create and modify arbitrary TF Content records because its public RecordController performs no authorization check and its shared frontend save controller writes the raw jform array without filtering it through the configured form. By pulling a valid Joomla token from the public login form and supplying an existing record ID, a guest - with no account, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - can mass-assign fields such as published, access, and created_by on any TF Content row. Impact is bounded to low confidentiality, integrity, and availability effects on TF Content data rather than full site compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, placing this as a genuine but moderate-priority issue.