CVE-2018-7314 Scanner

Joomla! is a widely used open-source content management system (CMS) utilized by individuals, small businesses, and large organizations for creating and managing websites. PrayerCenter is a third-party component for Joomla! that provides users with functionalities to manage and categorize prayer requests. It is commonly used by religious organizations and community groups to facilitate prayer request management on their Joomla! powered websites. Due to its integration with Joomla!, PrayerCenter is responsible for handling external inputs and converting them to database queries. This component is favored for its ease of use and ability to manage prayer submissions and approvals effectively.

The vulnerability CVE-2018-7314 is a SQL Injection flaw in the Joomla! Component PrayerCenter version 3.0.2. It arises because the component fails to properly sanitize user-supplied input before using it in SQL queries. Specifically, the sessionid parameter is directly concatenated into SQL statements without adequate validation or escaping. This allows an attacker to inject arbitrary SQL code, which the database server then executes. SQL Injection is a classic web application vulnerability that can lead to severe data breaches and system compromise.

The vulnerable endpoint is within the PrayerCenter component's handling of the sessionid parameter. This parameter is typically passed via HTTP requests, such as GET or POST, to manage user sessions or track prayer request submissions. The component's code does not use parameterized queries or prepared statements, making it susceptible to injection. An attacker can craft a malicious sessionid value containing SQL commands, such as UNION-based or blind injection payloads, to manipulate the database query. This allows the attacker to retrieve sensitive data or perform unauthorized operations.

If exploited, this vulnerability can have critical consequences. An attacker could extract all data from the Joomla! database, including user credentials, personal information, and prayer request details. They could also modify or delete data, potentially defacing the website or disrupting its functionality. With a CVSS score of 9.8, this vulnerability is considered critical and requires immediate attention. The impact extends to confidentiality, integrity, and availability of the affected system, making it a high-priority target for attackers.