AcyMailing (com_acymailing) below 4.9.5 - Authenticated SQL Injection (CVE-2015-7338)
AcyMailing 4.x and earlier (the legacy com_acymailing component, before the rename to com_acym at version 6) contain a SQL injection reachable through the exportgeolocorder action via the geolocation_longitude request parameter to index.php. CVSS 7.2 (High). Update to AcyMailing 4.9.5 or later; the supported path is AcyMailing 6+ (com_acym), which is covered by a separate rule. The version_low floor of 1.1.0 is deliberate: the unrelated "Xmap - AcyMailing Integration" plugin by Branko Wilhelm reports element com_acymailing at version 1.0.0 on 18 sites, and match_extension_type is not currently read by the matcher, so the floor is what keeps that plugin out of this rule.
Affected versions: ≥ 1.1.0 and < 4.9.5
Full advisory: nvd.nist.gov
