High · 7.2 CVE-2025-22210 EUVD-2025-4249GHSA-fvx6-jx94-49qx

Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla

Published Feb 25, 2025 · Updated Apr 4, 2025 · Assigned by Joomla

Vendor: hikashop.com Product: Hikashop component for Joomla Category: Web / CMS

Description

A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.

Affected products

Vendor	Product	Affected	Fixed
hikashop.com	Hikashop component for Joomla	3.3.0-5.1.4	—

Advisories 1

WID-SEC-2025-0431 Joomla: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Feb 24, 2025

References

https://www.hikashop.com/ product
https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22210 third-party-advisory