Skip to content
OpenAdvisories
Medium WID-SEC-2025-0431 4 CVEs

Joomla: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Published Feb 24, 2025 · Updated Feb 24, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um beliebige SQL-Befehle auszuführen.

Product

Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

  • High 7.2
    CVE-2025-22210

    Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla

    A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.

    hikashop.com Hikashop component for Joomla Web / CMS
  • Medium 4.7
    CVE-2025-22206

    Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla

    A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.

    joomsky.com JS Jobs component for Joomla Web / CMS
  • Medium 4.7
    CVE-2025-22208

    Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

    A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.

    joomsky.com JS Jobs component for Joomla Web / CMS
  • Medium 4.7
    CVE-2025-22209

    Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

    A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.

    joomsky.com JS Jobs component for Joomla Web / CMS

Revision history

  1. #1

    Initiale Fassung

References