Joomla Convert Forms SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Convert Forms component for Joomla, affecting versions 1.0.0 through 4.4.9. This vulnerability allows authenticated administrators to execute arbitrary SQL commands in the submission management area of the backend.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries, potentially leading to unauthorized data access or modification.

Reproduction

To reproduce this vulnerability, an authenticated administrator can navigate to the 'Convert Forms' submissions page. After selecting an unpublished form, the 'filter[form_id]' parameter can be exploited by injecting SQL payloads. This can be done by using a tool like Burp Suite to intercept and modify the request before it is sent to the server.

Remediation

Users are advised to update to Convert Forms version 4.4.10 or later.