Method remove_mapping at line 132 of com_conditions/src/Controller/ItemController.php gets
user input from the get element. This element’s value then flows through the code without
being properly sanitized or validated, and is eventually used in a database query in method
removeMapping at line 173 of com_conditions/src/Model/ItemModel.php. This may enable an
SQL Injection attack.
Source Destination
File com_conditions/src/Controller/ItemContr
oller.php
com_conditions/src/Model/ItemModel.ph
p
Line 134 188
Object get execute
Code Snippet
File Name com_conditions/src/Controller/ItemController.php
Method public function remove_mapping()
....
134. $extension = $this->input->get('extension', '')