RSForm!Pro Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability has been identified in the RSForm!Pro component for Joomla, specifically in versions 3.0.0 through 3.3.14. The vulnerability arises within the submission export feature, where filenames were not properly escaped before being exported to CSV. This issue requires administrative access to the export feature to be exploited.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where the vulnerable RSForm!Pro component is installed.
Remediation
Users can update to RSForm!Pro version 3.3.15, which addresses this vulnerability by properly escaping filenames before export. The update is available through the RSJoomla! website.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.