CVE-2015-4071

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/102Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jul/82Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/75971Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37666/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/102Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jul/82Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/75971Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37666/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-40725.4Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arb CVE-2015-40739.8Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL c CVE-2015-40747.5Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a CVE-2015-40758.1The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.CVE-2015-40772.1The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow lo CVE-2015-40783.1Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier CVE-2015-40806.8The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) ob CVE-2015-40826.5attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the e CVE-2015-40844.3Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-40857.5Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.CVE-2015-40898.8Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before CVE-2015-40917.5XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or pos