Unauthenticated Database Table List Disclosure in Fabrik Joomla Extension

Executive Summary

This vulnerability affects the Joomla extension Fabrik (versions below 4.7.2). It allows unauthenticated users to access a list of database tables and their prefixes through the ajax_tables method in the elements model. This could expose sensitive database structure information.

Useful 0 Not Useful 0

Detection Guidance

Check if your Joomla site uses Fabrik extension version below 4.7.2. Inspect network traffic for requests to the vulnerable ajax_tables method in the elements model. Look for responses containing database table names or prefixes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gather information about your database structure, including table names and prefixes. This data could be used for further attacks like SQL injection or unauthorized data access if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations could face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Fabrik extension to version 4.7.2 or higher immediately. If update is not possible, disable the Fabrik extension or restrict access to the ajax_tables method via server configuration.

Useful 0 Not Useful 0