« Volver al listado

CVE-2025-22212

Estado: AnalizadaBaja (2.7)—

A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Convert Forms Project — Convert Forms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22212",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22212",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-05T15:57:16.403725Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@joomla.org",
      "affectedData": [
        {
          "vendor": "tassos.gr",
          "product": "Convert Forms component for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-4.4.9"
            }
          ],
          "packageName": "com_convertforms",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-05T16:15:37.643",
  "references": [
    {
      "url": "https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22212",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@joomla.org"
    },
    {
      "url": "https://www.tassos.gr/",
      "tags": [
        "Product"
      ],
      "source": "security@joomla.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@joomla.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en el componente ConvertForms versiones 1.0.0-1.0.0 - 4.4.9 para Joomla permite a atacantes autenticados (administrador) ejecutar comandos SQL arbitrarios en el área de administración de envíos en el backend."
    }
  ],
  "lastModified": "2026-06-17T08:45:37.507",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:convert_forms_project:convert_forms:*:*:*:*:*:joomla\\!:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B92AAED4-B675-418E-984F-A8B7CB0CA7DE",
              "versionEndExcluding": "4.4.9",
              "versionStartIncluding": "1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@joomla.org"
}