The attacker must be logged in with at least manager level access or access to the administrative panel to exploit this vulnerability. XSS in ./admin/views/slider/tmpl/default.php via id variable: 275: <a class="modal" rel="{handler: 'iframe', size: {x: 800, y: 500}}" href="index.php?option=com_slider&view=video&tmpl=component&pid=<?php echo $_GET['id']; ?>" title="Video" > SQL Injection in the following sections of code: in file ./admin/models/slider.php 53: $id_cat = JRequest::getVar('id'); 54- $query = $db->getQuery(true); 55- $query->select('#__huge_itslider_images.name as name,' 56- . '#__huge_itslider_images.id ,' 57- . '#__huge_itslider_sliders.name as portName,' 58- . 'slider_id, #__huge_itslider_images.description as description,image_url,sl_url,sl_type,link_target,#__huge_itslider_images.ordering,#__huge_itslider_images.published,published_in_sl_width'); -- 69: $id_cat = JRequest::getVar('id'); 70- $query = $db->getQuery(true); 71- $query->select('*'); 72- $query->from('#__huge_itslider_images'); 73- $query->where('slider_id=' . $id_cat); 74- $db->setQuery($query); -- 117: $id_cat = JRequest::getVar('id'); 118- 119- $query = $db->getQuery(true); 120- $query->update('#__huge_itslider_sliders')->set('name ="' . $name . '"') 121- ->set('sl_height="' . $sl_height . '"')->set('slider_list_effects_s="' . $slider_effects_list . '"') 122- ->set('pause_on_hover="' . $pause_on_hover . '"') -- 133: $id_cat = JRequest::getVar('id'); 134- $query = $db->getQuery(true); 135- $query->update('#__huge_itslider_sliders')->set('slider_list_effects_s ="' . $styleName . '"')->where('id="' . $id_cat . '"'); 136- $db->setQuery($query); 137- $db->execute(); 138- } -- 182: $id_cat = JRequest::getVar('removeslide'); 183: $id = JRequest::getVar('id'); 184- $db = JFactory::getDBO(); 185- $query = $db->getQuery(true); 186- $query->delete('#__huge_itslider_images')->where('id =' . $id_cat); 187- $db->setQuery($query); 188- $db->execute();