Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Phil-a-Form lets remote users run database commands

CVE-2007-2933 · published 19 years ago
Summary

The Phil-a-Form component for Joomla can be tricked into running unwanted database queries when a specially crafted form_id value is sent. This could let an attacker read, change, or delete data stored by your website. Update to a newer version of Phil-a-Form or remove the component until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
phil-a-form phil-a-form 1.2.0.0
cpe:2.3:a:phil-a-form:phil-a-form:1.2.0.0:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the form_id param...
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the form_id parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published31 May 2007
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-2933 · NVD
Track software like this
Free during beta