CVE-2018-25351

Executive Summary

CVE-2018-25351 is an unauthenticated error-based SQL injection vulnerability in the Joomla! component EkRishta version 2.10. The flaw resides in the login endpoint where user-supplied input to the username parameter is concatenated into SQL queries without proper sanitization or parameterization. Attackers can exploit this by submitting crafted POST requests with SQL injection payloads, enabling the extraction of sensitive data such as user credential hashes, system configuration, and potentially the complete application database. The vulnerability is rated CVSS 8.2 (High) due to network exploitability requiring no authentication or user interaction. No CISA KEV inclusion or active exploitation campaigns have been confirmed, but the attack surface remains significant for Joomla deployments using the legacy EkRishta extension.

Technical Analysis

The EkRishta component (com_ekrishta) version 2.10 implements a login authentication mechanism that fails to properly sanitize user-supplied input destined for database queries. The vulnerability class is error-based SQL injection (CWE-89), meaning the application returns database error messages to the client, which can be leveraged for both reconnaissance and data exfiltration.

The vulnerable code path is triggered when a user submits a POST request to the login endpoint (typically index.php?option=com_ekrishta&task=login). The username parameter is directly concatenated into an SQL SELECT statement prepared by the component's model. A typical vulnerable query would take a form such as:

SELECT id, username, password FROM #__users WHERE username = '$_POST['username']' AND password = '...'

Because the parameter is not passed through prepared statements, query escaping, or Joomla's JDatabaseDriver::escape() method, an attacker can break out of the quoted string context. For error-based exploitation, the attacker appends functions like UPDATEXML(), EXTRACTVALUE(), or GTID_SUBSET() that generate verbose MySQL errors echoing the result of a subquery.

The attack surface includes the Joomla administrator backend if EkRishta exposes a login widget there, as well as any front-end login form provided by the component. Since the component's login endpoint operates independently of Joomla's core authentication, it may be reachable on public-facing sites without requiring a registered account. The injected payload is delivered via standard form POST encoding (application/x-www-form-urlencoded), making the traffic nearly indistinguishable from legitimate login attempts at the network layer.

The NVD description specifies error-based injection, confirming that stacked queries (e.g., ; DROP TABLE) are not directly executable on this platform, but data extraction through error messages is fully functional. The attack requires no authentication, and the POST request is lightweight, making it easy to automate with tools such as sqlmap targeted against the specific endpoint.

Exploitation Scenarios

A complete attack chain against CVE-2018-25351 proceeds as follows:

Step 1 — Reconnaissance: The attacker identifies Joomla-based sites by fingerprinting the CMS via headers (X-Content-Encoded-By: Joomla!), the /administrator/ path, or the generator meta tag. They further probe for the EkRishta component by requesting known component paths (index.php?option=com_ekrishta) and look for distinctive error messages or URLs. Shodan queries for http.title:"Joomla" combined with footer or asset references to com_ekrishta narrow the target set.

Step 2 — Endpoint Discovery: The attacker enumerates the component's tasks to locate the login handler. Common paths include:

• index.php?option=com_ekrishta&task=user.login
• index.php?option=com_ekrishta&view=login
• Direct POST to the component's controller (index.php?option=com_ekrishta)

A standard GET request to these endpoints in a non-authenticated session typically returns the login form, confirming the attack surface.

Step 3 — Payload Crafting: Without a public PoC, the attacker applies standard MySQL error-based injection payloads. The username parameter is injected as:

username=admin' AND UPDATEXML(1, CONCAT(0x7e, (SELECT @@version), 0x7e), 1)-- -&password=anything

The UPDATEXML function triggers an XML parsing error that includes the string passed to it, which is the subquery result (here, the MySQL version). The attacker replaces @@version with more damaging subqueries, such as:

username=admin' AND UPDATEXML(1, CONCAT(0x7e, (SELECT GROUP_CONCAT(username,0x3a,password) FROM #__users LIMIT 1), 0x7e), 1)-- -&password=x

To extract data row-by-row, the attacker increments a LIMIT offset or uses SUBSTRING() within the subquery for iterative length-based extraction.

Step 4 — Data Exfiltration: Each crafted POST request causes the application to output an error page containing the exfiltrated data fragment. Automated tools like sqlmap with the --technique=E --dbms=mysql flags can be scripted to issue hundreds of requests per minute, pulling down the full #__users table (containing admin password hashes — typically bcrypt for Joomla 3.x+), the #__session table, and configuration secrets.

Step 5 — Post-Exploitation: With the admin hash in hand, the attacker attempts offline password cracking (e.g., with john or hashcat) or, if the site runs an older Joomla version where MD5 hashes remain (2.5 or earlier), directly reverse the hash. Successful admin login grants the ability to install malicious Joomla extensions, modify templates to drop web shells, pivot to the underlying file system, or use the site as a platform for phishing and malware distribution.

Blast Radius Caveat: The exploitation is entirely remote, requires no credentials, and the request surface is exposed to the public Internet. The injected SQL runs under the database user privileges, which for Joomla deployments is often the same account with broad database rights (e.g., ALL PRIVILEGES ON joomla.*), but file system write access usually requires FILE privilege, which is often disabled.

Impact Assessment

The CVSS v3.0 base score of 8.2 reflects a high-severity, network-exploitable vulnerability with significant confidentiality impact (C:H) and limited integrity (I:L) and availability (A:L) impact, per the typical vector mapping.

• Confidentiality (High): Attackers can extract all database contents, including hashed credentials for all registered users, admin accounts, session tokens, and sensitive application data such as user PII, orders, or other business records stored by the Joomla CMS and EkRishta component. The full database dump can be executed within minutes using automated tooling.
• Integrity (Low): Error-based injection is read-oriented, but in some MySQL configurations the payload could be combined with INTO OUTFILE if FILE privilege is available, potentially writing a web shell. This is less common but elevates the risk profile for high-value targets.
• Availability (Low): Repeated error generation, especially with functions like SLEEP() combined with error-based output (e.g., AND SLEEP(5) plus a deliberate syntax error), can cause database CPU spikes. In high-traffic environments, this could degrade site responsiveness.

The business impact is disproportionately large for organizations that rely on Joomla with the EkRishta extension — typically small- to mid-size e-commerce, matrimonial matchmaking, or classified ad portals. A full database breach exposes customer records, leading to regulatory fines (GDPR, CCPA), loss of customer trust, and potential identity theft. If the attacker escalates to admin access (via password cracking), the site can be defaced, used to serve malware, or leveraged for SEO spam, resulting in long-term reputational and financial damage.

Detection Guidance

Sigma Rule

title: Joomla EkRishta SQL Injection Attempt
id: 7f3d6c9e-5a2c-4e1a-8b3f-aa1c9f22d8b4
status: experimental
description: Detects POST requests to Joomla EkRishta login endpoint containing SQL injection patterns in the username parameter
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'option=com_ekrishta'
  injection_patterns:
    cs-body|contains:
      - 'username=*UPDATEXML*'
      - 'username=*EXTRACTVALUE*'
      - 'username=*GTID_SUBSET*'
      - "username=*'%20AND%20*"
      - 'username=*SELECT+UNION*'
      - 'username=*SLEEP(*'
  condition: selection and injection_patterns
falsepositives:
  - Legitimate penetration testing activities
  - WAF bypass testing
level: high
tags:
  - attack.t1190
  - cve.2018.25351

YARA Rule

rule Joomla_EkRishta_SQLi_Payloads
{
    meta:
        author = "Valters IT Security"
        description = "Detect SQL injection payloads targeting Joomla EkRishta login username parameter"
        cve = "CVE-2018-25351"
        date = "2025-01-12"
        severity = "high"
    strings:
        $uri1 = "option=com_ekrishta" ascii wide nocase
        $uri2 = "view=login" ascii wide nocase
        $func1 = "UPDATEXML(" ascii wide nocase
        $func2 = "EXTRACTVALUE(" ascii wide nocase
        $func3 = "GTID_SUBSET(" ascii wide nocase
        $func4 = "SLEEP(" ascii wide nocase
        $sqli1 = "username=" ascii wide nocase
        $sqli2 = "' AND " ascii wide nocase
        $sqli3 = "CONCAT(0x" ascii wide nocase
        $sqli4 = "UNION SELECT" ascii wide nocase
    condition:
        any of ($uri*) and any of ($func*) and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2018-25351 Joomla EkRishta SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"option=com_ekrishta"; http_uri; nocase; content:"username="; http_client_body; pcre:"/username=(.*)(UPDATEXML|EXTRACTVALUE|GTID_SUBSET|SLEEP|%27%20AND%20|UNION%20SELECT)/Ui"; classtype:web-application-attack; reference:cve,2018-25351; sid:2025011201; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.type == "start" and 
    network.protocol == "http" and 
    url.path contains "option=com_ekrishta" and 
    http.request.method == "POST" ]
  [ http where event.category == "web" and 
    http.request.body.content contains "username=" and 
    (http.request.body.content contains "UPDATEXML" or 
     http.request.body.content contains "EXTRACTVALUE" or 
     http.request.body.content contains "GTID_SUBSET" or 
     http.request.body.content contains "SLEEP" or 
     http.request.body.content contains "AND" or 
     http.request.body.content contains "UNION") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri=*option=com_ekrishta*
| rex field=form_data "username=(?<username_param>[^&]+)"
| where username_param LIKE "%UPDATEXML%" 
    OR username_param LIKE "%EXTRACTVALUE%" 
    OR username_param LIKE "%GTID_SUBSET%" 
    OR username_param LIKE "%SLEEP%" 
    OR username_param LIKE "%'%20AND%"
    OR username_param LIKE "%UNION%"
| table _time, clientip, uri, username_param, status
| sort - _time

Wazuh OSSEC Rule

<rule id="100251" level="12">
  <decoded>web-access-log</decoded>
  <match>option=com_ekrishta</match>
  <regex>POST</regex>
  <regex>username=(.*(UPDATEXML|EXTRACTVALUE|GTID_SUBSET|SLEEP|%27%20AND%20|UNION%20SELECT))</regex>
  <description>CVE-2018-25351 - Joomla EkRishta SQL Injection payload in username parameter</description>
  <group>web_application_attack,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Status: The claim of a patch is unverified (patch confidence 2/4). The EkRishta component is an abandoned third-party extension with no public security advisory or updated build as of the time of publication. Organizations must assume the component remains vulnerable indefinitely.

Immediate Mitigations (1-2 days):

1. Disable or remove the EkRishta component immediately. If the functionality is non-critical, unpublishing the component (or removing it entirely via Joomla's extension manager) is the only guaranteed method to close the attack surface.
2. If immediate removal is infeasible, use a Web Application Firewall (WAF) with virtual patching. Implement a custom rule blocking POST requests to any URI containing option=com_ekrishta where the username parameter contains SQL metacharacters (single quote, AND, UNION, SLEEP, UPDATEXML, EXTRACTVALUE, GTID_SUBSET).
3. Restrict network access at the perimeter — block external traffic to the login endpoint if the component is only used by internal staff.

Patch/Upgrade Steps (1-2 weeks):

1. Migrate away from EkRishta. Since this is an abandoned plugin, there is no vendor patch to apply. Search Joomla's extension directory for a maintained alternative (e.g., a matrimonial/listing component actively supported by its developer).
2. If the extension is replaced with a maintained equivalent, ensure the underlying data is migrated securely; then drop all EkRishta database tables.
3. For Joomla core: upgrade to the latest stable Joomla version (4.x or 3.10.x LTS) to ensure core SQL hardening is intact, even though the vulnerability lies in the component, not core.

Long-Term Hardening (1-3 months):

1. Enforce least-privilege database account: Ensure the Joomla database user has only SELECT, INSERT, UPDATE, DELETE privileges on the dedicated Joomla database, and revoke FILE, GRANT OPTION, and cross-database privileges.
2. Implement a web application firewall with managed rules for OWASP Top 10 and set it to block/detect SQLi signatures to protect against unknown components carrying similar flaws.
3. Adopt a patch management policy requiring all third-party Joomla extensions to have a recent release (within 12 months) and a known security contact. Immediately quarantine extensions that are abandoned or lack security advisories.
4. Deploy database activity monitoring (e.g., audit logs on failed queries) to catch error-based injection attempts even if WAF bypasses occur.
5. Regular security assessments: Run quarterly authenticated dynamic application security testing (DAST) against the Joomla instance to identify vulnerable components early.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2018-25351 — Official National Vulnerability Database record (referenced description and CVSS base score).
2. Joomla! Official Extension Directory: https://extensions.joomla.org/ — Reference for identifying maintained alternatives and assessing extension lifecycle.
3. OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html — Industry-standard mitigation guidance for SQLi vulnerabilities.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploitation of Public-Facing Application technique mapping for detection planning.
5. Exploit-DB (Joomla Extension Exploits): https://www.exploit-db.com/ — Reference for existing PoCs against similar Joomla components; no public PoC has been confirmed for CVE-2018-25351 at the time of writing.

Threat Actor Context: No active exploitation campaigns or threat actor associations have been publicly attributed to this CVE. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, SQL injection flaws in unmaintained Joomla components are a common target for mass-scanning botnets and low-sophistication attackers who automate exploitation across the Internet, using the extracted credential hashes for cryptocurrency mining server deployments or phishing infrastructure. Given the age of the component (last updated 2018) and the volume of scanning traffic observed against Joomla instances, assume this CVE is being actively probed by autonomous scanners even if manual exploitation has not been documented.