SQL Injection Vulnerability in Joomla Database Package
CVE-2025-25226

9.8CRITICAL

Key Information:

Vendor
Joomla
Status
Joomla! Framework
Vendor
CVE Published:
8 April 2025

Summary

A vulnerability has been identified in the quoteNameStr method of the Joomla database package, resulting from improper handling of identifiers that can lead to SQL injection. While the method is protected and lacks direct usage in the standard 2.x or 3.x branches, extensions that inherit from this class may expose systems to potential exploitation if they utilize this vulnerable method.

Affected Version(s)

Joomla! Framework 1.0.0-2.1.1

Joomla! Framework 3.0.0-3.3.1

References

https://developer.joomla.org/security-centre/963-20250401...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicholas K. Dionysopoulos, akeeba.com
.