Improper input validation in Joomla

CVE-2008-6882

Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.023 (81.4th percentile) — read the EPSS interpretation.

Affected products

Joomla
Joompolitan Com_livechat — versions 1.0
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)