Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Joomla SEF404x component lets attackers run code

CVE-2010-2681 · published 16 years ago
Summary

The SEF404x extension used with Joomla can be tricked into loading a web address supplied by an attacker, causing the server to execute that code. This gives a remote hacker the ability to take control of the website or steal data. Apply the vendor's update or remove the component and ensure the site is running the latest Joomla version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
joomla com_sef All versions
cpe:2.3:a:joomla:com_sef:*:*:*:*:*:*:*:*
Original advisory text
PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to in...
PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to index.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published12 Jul 2010
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2010-2681 · NVD
Track software like this
Free during beta