CVE-2020-37226

HIGH

Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-37226. PoCs published by Mehmet Kelepçe.

AI-analyzed exploit summary This exploit demonstrates an authenticated SQL injection vulnerability in Joomla! J2 JOBS 1.3.0 via the 'sortby' parameter. The provided HTTP request and sqlmap command show how to exploit the vulnerability to extract database information.

Description

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'sortby' parameter. Attackers can send POST requests to the administrator index with malicious 'sortby' values to extract sensitive database information using automated tools.

Exploits (1)

exploitdb WORKING POC
by Mehmet Kelepçe · textwebappsphp
https://www.exploit-db.com/exploits/48670

This exploit demonstrates an authenticated SQL injection vulnerability in Joomla! J2 JOBS 1.3.0 via the 'sortby' parameter. The provided HTTP request and sqlmap command show how to exploit the vulnerability to extract database information.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Joomla! J2 JOBS 1.3.0
Auth required
Prerequisites: Authenticated access to the Joomla administrator panel
devstral-2 · analyzed May 13, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-48670
https://www.exploit-db.com/exploits/48670
Product product
Official Product Homepage
https://joomsky.com/
Product product
Product Reference
https://joomsky.com/products/js-jobs-pro.html
Third Party Advisory third-party-advisory
VulnCheck Advisory: Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
https://www.vulncheck.com/advisories/joomla-j2-jobs-authenticated-sql-injection-via-sortby-2

Scores

CVSS v3 7.1
EPSS 0.0027
EPSS Percentile 18.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
Joomsky/J2 JOBS 1.3.0
Published May 13, 2026
Tracked Since May 13, 2026