Touch Slider Extension For Joomla
Monthly
Unauthenticated attackers can delete arbitrary slider images and replace the entire OrdaSoft Touch Slider database tables site-wide via the module's AJAX handler in versions below 5.4.6. The handler modOsTouchSliderHelper::getAjax() lacks any JFactory::getUser(), authorise(), or CSRF-token check, so exploitation requires no session or task parameter and works against default configurations where the module is installed and enabled. No public exploit identified at time of analysis.
Unauthenticated attackers can delete arbitrary slider images and replace the entire OrdaSoft Touch Slider database tables site-wide via the module's AJAX handler in versions below 5.4.6. The handler modOsTouchSliderHelper::getAjax() lacks any JFactory::getUser(), authorise(), or CSRF-token check, so exploitation requires no session or task parameter and works against default configurations where the module is installed and enabled. No public exploit identified at time of analysis.