The Parcoauto component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Credit:
The information has been provided by Andrea Bocchetti.
Parcoauto component for Joomla! is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the index.php script using the idVeicolo parameter, which could allow the attacker to view, add, modify or delete information in the back-end database.
Exploit:
An attacker can exploit this issue using a browser.
The following example URI is available:
http://www.example.com/index.php?option=com_parcoauto&action=scheda&idVeicolo=2658810
