TLDR Tech / InfoSec
Joomla! Novarain/Tassos Framework Vulnerabilities
Three critical unauthenticated vulnerabilities — arbitrary file read, arbitrary file deletion, and SQL injection — were disclosed in the Novarain/Tassos Framework (v4.10.14–v6.0.37), a shared system plugin shipped with five widely deployed Joomla! extensions including Convert Forms, EngageBox, and Advanced Custom Fields. Chained together, the flaws enable reliable RCE and administrator account takeover by dumping active super admin sessions via SQLi, then authenticating to upload malicious extensions. Administrators should update affected extensions immediately or disable the plg_system_nrframework plugin and restrict access to com_ajax endpoints via WAF rules.
Read the full story