CVE-2025-25226
published 2025-04-08CVE-2025-25226: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.45%
36.0th percentile
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joomla!_project | joomla!_framework | — | — |
| joomla!_project | joomla!_framework | — | — |
| joomla | database | >= 1.0.0 < 2.2.0 | 2.2.0 |
| joomla | database | >= 3.0.0 < 3.4.0 | 3.4.0 |
| joomla | joomla_! | >= 1.0.0 < 2.2.0 | 2.2.0 |
| joomla | joomla_! | >= 3.0.0 < 3.4.0 | 3.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Joomla Framework Database Package Vulnerable to SQL Injection
osv·2025-04-08
CVE-2025-25226 [MEDIUM] Joomla Framework Database Package Vulnerable to SQL Injection
Joomla Framework Database Package Vulnerable to SQL Injection
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
GHSA
Joomla Framework Database Package Vulnerable to SQL Injection
ghsa·2025-04-08
CVE-2025-25226 [MEDIUM] CWE-89 Joomla Framework Database Package Vulnerable to SQL Injection
Joomla Framework Database Package Vulnerable to SQL Injection
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-08
Published