CVE-2018-25351
HIGHJoomla! Component EkRishta 2.10 SQL Injection via username
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25351. PoCs published by L0RD.
AI-analyzed exploit summary This is a functional SQL injection exploit targeting the 'username' parameter in Joomla! Component EkRishta 2.10. The payload uses an error-based SQLi technique with `extractvalue` to leak database user information.
Description
Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter. Attackers can submit POST requests to the login endpoint with SQL injection payloads in the username field to extract database information including user credentials and system details.
Exploits (1)
This is a functional SQL injection exploit targeting the 'username' parameter in Joomla! Component EkRishta 2.10. The payload uses an error-based SQLi technique with `extractvalue` to leak database user information.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N