Skip to content
Fencer Intel
high 7.5

CVE-2010-0158 json

SQL injection vulnerability in the JoomlaBamboo (JB) Simpla Admin template for Joomla!

published 2010-01-06 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-0189

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
1
Exploit-DB

Summary

SQL injection vulnerability in the JoomlaBamboo (JB) Simpla Admin template for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to the com_content component, reachable through index.php. NOTE: the vendor disputes this report, saying: "JoomlaBamboo has investigated this report, and it is incorrect. There is no SQL injection vulnerability involving the id parameter in an article view, and there never was. JoomlaBamboo customers have no reason to be concerned about this report.

Timeline

  1. First public exploit (EDB-10971)
  2. Published

Exploit prediction

1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-10971 Joomla! Component Bamboo Simpla Admin Template - SQL Injection webapps, 2010-01-03
  • securityfocus.com http://www.securityfocus.com/bid/37579 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.org http://packetstormsecurity.org/1001-exploits/joomlabamboo-sql.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.