CVE-2018-25330

High

Published: 17/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The EkRishta 2.10 extension for Joomla! contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters.

Risk Assessment

Attackers can inject script payloads in profile information fields, leading to the execution of malicious code when users visit the profile, and manipulate database queries via SQL injection through the phone_no parameter.

Recommendation

It is recommended to update the EkRishta extension to the latest version and review and secure profile fields and POST parameters against injections.

Other vulnerabilities in EkRishta 2.10

CVE-2018-25351High
Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter.

Original NVD description (English source)

Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.