Joomla! Component My Projects 2.0 SQL Injection
Description
Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=2.0
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization in the VerAyari parameter allows direct SQL command injection."
Attack vector
An unauthenticated attacker crafts a request to the My Projects component endpoint, injecting SQL commands through the `VerAyari` parameter. The proof-of-concept URL appends a stacked SQL payload that uses `count(*)`, `concat`, and `floor(rand(0)*2)` to extract database information via error-based or blind injection [ref_id=1]. No authentication or special privileges are required, making the attack surface broad.
Affected code
The vulnerability resides in the Joomla! component My Projects version 2.0. The `VerAyari` parameter in the URL path `/index.php/component/myproject/VerAyari` is directly concatenated into SQL queries without sanitization, allowing unauthenticated SQL injection [ref_id=1].
What the fix does
The advisory does not include a patch diff or vendor fix. The recommended remediation is to sanitize and parameterize all user-supplied input, particularly the `VerAyari` parameter, before including it in SQL queries. Without a published fix, administrators should disable or remove the component until a patched version is released [ref_id=1].
Preconditions
- configThe Joomla! My Projects component version 2.0 must be installed and enabled.
- authNo authentication is required; the endpoint is publicly accessible.
- networkThe attacker must be able to send HTTP requests to the Joomla! instance.
- inputThe attacker supplies a malicious SQL payload in the VerAyari URL parameter.
Reproduction
1. Identify a Joomla! site running My Projects 2.0. 2. Send a GET request to `http://target/index.php/component/myproject/VerAyari'and%20(select%201%20from%20(select%20count(*)%2cconcat((select(select%20concat(cast(database()%20as%20char)%2c0x7e))%20from%20information_schema.tables%20where%20table_schema=database()%20limit%200%2c1)%2cfloor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20AND%20''='`. 3. Observe error messages or timing differences that leak database contents such as the database name and table structure [ref_id=1].
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/43358mitreexploit
- www.vulncheck.com/advisories/joomla-component-my-projects-sql-injectionmitrethird-party-advisory
- www.gegabyte.orgmitreproduct
- extensions.joomla.org/extensions/extension/directory-a-documentation/portfolio/my-projects/mitreproduct
News mentions
0No linked articles in our index yet.