Persistent Cross-Site Scripting and SQL Injection in EkRishta 2.10 by Joomla!
CVE-2018-25330

8.8HIGH

Key Information:

Vendor: Joomlaextensions
Status: Joomla! Extension Ekrishta
Vendor: CVE Published:; 17 May 2026

🔔 Create Joomlaextensions Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25330?

The EkRishta 2.10 extension for Joomla! has been identified to contain serious security vulnerabilities, specifically persistent cross-site scripting (XSS) and SQL injection flaws. These vulnerabilities can be exploited by attackers who insert malicious code into user profile fields, such as the Address field, which executes when other users access the profile. Additionally, SQL injection can be leveraged via manipulating the phone_no parameter at the user_setting endpoint, allowing attackers to execute arbitrary SQL queries against the database. It is crucial for Joomla! users to address these vulnerabilities to safeguard their applications against potential exploitation.

Affected Version(s)

Joomla! extension EkRishta 2.10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25330 - Proof of Concept