CVE-2014-7228

Description

Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.

Sévérité

7.5 Élevée · CVSS 2.0

AV:N/AC:L/Au:N/C:P/I:P/A:P

Score retenu : NVD

Source	Sévérité d'origine	CVSS
NVD	HIGH	7.5 (v2.0)

Produit et versions

Produit: Joomla CMS
Corrigée dans: Non précisée
Publiée: 03/11/2014
Modifiée: 17/06/2026
CWE: CWE-310

Versions concernées

2.5.4 – 2.5.4
2.5.5 – 2.5.5
2.5.6 – 2.5.6
2.5.7 – 2.5.7
2.5.8 – 2.5.8
2.5.9 – 2.5.9
2.5.10 – 2.5.10
2.5.11 – 2.5.11
2.5.12 – 2.5.12
2.5.13 – 2.5.13
2.5.14 – 2.5.14
2.5.15 – 2.5.15

33 autres

2.5.16 – 2.5.16
2.5.17 – 2.5.17
2.5.18 – 2.5.18
2.5.19 – 2.5.19
2.5.20 – 2.5.20
2.5.21 – 2.5.21
2.5.22 – 2.5.22
2.5.23 – 2.5.23
2.5.24 – 2.5.24
2.5.25 – 2.5.25
3.0.0 – 3.0.0
3.0.1 – 3.0.1
3.0.2 – 3.0.2
3.0.3 – 3.0.3
3.0.4 – 3.0.4
3.1.0 – 3.1.0
3.1.1 – 3.1.1
3.1.2 – 3.1.2
3.1.3 – 3.1.3
3.1.4 – 3.1.4
3.1.5 – 3.1.5
3.1.6 – 3.1.6
3.2.0 – 3.2.0
3.2.1 – 3.2.1
3.2.2 – 3.2.2
3.2.3 – 3.2.3
3.2.4 – 3.2.4
3.2.5 – 3.2.5
3.3.0 – 3.3.0
3.3.1 – 3.3.1
3.3.2 – 3.3.2
3.3.3 – 3.3.3
3.3.4 – 3.3.4

Sources

NVD CVE-2014-7228 vu il y a 3 h

Ces informations proviennent des sources ci-dessus ; CVE Oyer n'y ajoute aucune interprétation.

Historique

Détectée via nvd26/09/2026 09:34 UTC