Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Helpdesk Pro for Joomla lets attackers run database commands

CVE-2015-4073 · published 9 years ago
Summary

Versions of the Helpdesk Pro plugin for Joomla earlier than 1.4.0 contain weaknesses that let a remote user craft special ticket codes, email values or ordering settings to run any database command they choose. This could expose or change your support data. Update the plugin to version 1.4.0 or later (or apply the vendor’s patch) and verify that no unauthorized changes were made to the database.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
helpdesk_pro_project helpdesk_pro <= 1.3.0
cpe:2.3:a:helpdesk_pro_project:helpdesk_pro:*:*:*:*:*:joomla\!:*:*
Original advisory text
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or...
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published20 Sep 2017
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-4073 · NVD
Track software like this
Free during beta