CVE-2018-12254

Vulnerability

router.php in the Harmis Ek-rishta (ek-rishta) component version 2.10 for Joomla! is vulnerable to SQL Injection. The PATH_INFO parameter passed to a URI like home/requested_user/Sent%20interest/ is directly concatenated into an SQL query without sanitization, allowing an attacker to inject arbitrary SQL commands. The component was developed by Harmis, and the vulnerability was publicly disclosed on June 11, 2018 [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to any page that uses the vulnerable routing mechanism. No authentication is required. The proof-of-concept payload 1'or%20sleep(5)%23 demonstrates time-based injection, but the researcher found that error-based exploitation using extractvalue() (XPATH Injection) is more effective due to limitations in query responses [1]. The injectable parameter is the third segment after Sent%20interest/ in the URL path.

Impact

Successful exploitation allows an attacker to extract sensitive data from the Joomla database, including user credentials, configuration data, and any other information stored in the database. The attack is performed using error-based SQL injection via extractvalue(), which can leak database contents row by row. The attacker gains read access to the entire database but does not achieve file write or remote code execution [1].

Mitigation

As of the publication date on June 12, 2018, no patched version of the Ek-rishta component was available. The component version 2.10 is affected. Users should disable or remove the component until a security update is released by the vendor. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].