Vehicle Manager Free Extension For Joomla
Monthly
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Reflected cross-site scripting in the Vehicle Manager (Free) extension for Joomla before 6.5.8 allows an unauthenticated attacker to inject arbitrary markup and script into a page by crafting a malicious 'title' parameter on the public vehicle-detail page (task=view). The parameter is echoed straight into a double-quoted HTML attribute with no output encoding, so a double-quote character breaks out of the attribute and permits a <script> tag to be injected; exploitation requires the victim to follow a crafted link (CVSS 4.0 vector shows PR:N with UI:P, yielding a base score of 5.3). No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, so this is a genuine but low-severity reflected XSS whose practical impact is limited to script execution in the context of a victim user's session.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Reflected cross-site scripting in the Vehicle Manager (Free) extension for Joomla before 6.5.8 allows an unauthenticated attacker to inject arbitrary markup and script into a page by crafting a malicious 'title' parameter on the public vehicle-detail page (task=view). The parameter is echoed straight into a double-quoted HTML attribute with no output encoding, so a double-quote character breaks out of the attribute and permits a <script> tag to be injected; exploitation requires the victim to follow a crafted link (CVSS 4.0 vector shows PR:N with UI:P, yielding a base score of 5.3). No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, so this is a genuine but low-severity reflected XSS whose practical impact is limited to script execution in the context of a victim user's session.