CVE-2025-22206

MEDIUM

JS Jobs 1.1.5-1.4.2 - Authenticated SQL Injection via GDPR Field Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-22206. PoCs published by AdamWallwork.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2025-22206, demonstrating a SQL injection vulnerability in the JS Jobs Joomla plugin via the 'fieldfor' parameter. The PoC includes a captured HTTP request and SQLMap commands to exploit the vulnerability.

Description

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.

Exploits (1)

github WORKING POC
by AdamWallwork · poc
https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22206

This repository contains a functional proof-of-concept for CVE-2025-22206, demonstrating a SQL injection vulnerability in the JS Jobs Joomla plugin via the 'fieldfor' parameter. The PoC includes a captured HTTP request and SQLMap commands to exploit the vulnerability.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: JS Jobs Joomla plugin versions 1.1.5-1.4.2
Auth required
Prerequisites: Authenticated access as an administrator · Burp Suite or similar tool to capture HTTP requests · SQLMap for exploitation
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory third-party-advisory
https://decrypt.locker/obtaining-my-first-cve/

Scores

CVSS v3 4.7
EPSS 0.0871
EPSS Percentile 94.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
joomsky/js_jobs 1.1.5 - 1.4.2
Published Feb 04, 2025
Tracked Since Feb 18, 2026