CVE-2018-25351
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter.
Risk Assessment
Attackers can submit POST requests to the login endpoint with SQL injection payloads in the username field to extract database information including user credentials and system details, potentially leading to full system compromise.
Recommendation
Immediately update the EkRishta component to the latest available version or disable it if not essential, and implement parameterized SQL queries in the application.
Original NVD description (English source)
Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter. Attackers can submit POST requests to the login endpoint with SQL injection payloads in the username field to extract database information including user credentials and system details.