CVE-2025-49484

HIGH

JS Jobs component for Joomla 1.0.0-1.4.1 - Authenticated SQL Injection via 'cvid' Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-49484. PoCs published by Adam Wallwork, AdamWallwork.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in the Joomla JS Jobs plugin v1.4.2 via the 'cvid' parameter. It includes a captured HTTP request and sqlmap commands to exploit the vulnerability, confirming the presence of boolean-based and time-based blind SQLi.

Description

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature.

Exploits (2)

exploitdb WORKING POC
by Adam Wallwork · textwebappsphp
https://www.exploit-db.com/exploits/52373

This exploit demonstrates an SQL injection vulnerability in the Joomla JS Jobs plugin v1.4.2 via the 'cvid' parameter. It includes a captured HTTP request and sqlmap commands to exploit the vulnerability, confirming the presence of boolean-based and time-based blind SQLi.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Joomla JS Jobs plugin v1.4.2
Auth required
Prerequisites: Authenticated access as a jobseeker user · sqlmap tool
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by AdamWallwork · poc
https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-49484

The repository contains functional SQL injection PoCs for multiple CVEs, including CVE-2025-49484, targeting Joomla's JS Jobs component. The PoCs include HTTP requests and SQLMap commands to exploit vulnerable parameters like 'fieldfor' and 'filter_email'.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: JS Jobs component for Joomla (versions 1.1.5-1.4.3)
Auth required
Prerequisites: Authenticated access (administrator) · SQLMap tool · Burp Suite for request capture
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (3)

Core 3
Core References
Various Sources product
https://joomsky.com/js-jobs-joomla/
Exploit, Third Party Advisory exploit
https://www.exploit-db.com/exploits/52373

Scores

CVSS v4 8.7
EPSS 0.0108
EPSS Percentile 78.3%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
joomsky.com/JS Jobs component for Joomla 1.0.0-1.4.1
Published Jul 18, 2025
Tracked Since Feb 18, 2026