CVE-2018-25433
Description
Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malicious SQL code through the categoryid parameter. Attackers can send GET requests to index.php with crafted categoryid values in the com_jephotogallery component to execute arbitrary SQL queries and retrieve sensitive data like usernames and password hashes.
Affected products
1- Range: = 1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application does not properly sanitize the `categoryid` parameter before using it in SQL queries, allowing for SQL injection."
Attack vector
An unauthenticated attacker can exploit this vulnerability by sending a crafted GET request to `index.php` within the `com_jephotogallery` component. The malicious payload is injected into the `categoryid` parameter. This allows the attacker to execute arbitrary SQL queries against the database, potentially extracting sensitive information. The exploit targets the `fetchimage` task to achieve this.
Affected code
The vulnerability lies within the `com_jephotogallery` component of Joomla!, specifically when handling the `categoryid` parameter in the `fetchimage` task. The exploit code demonstrates constructing a URL that targets `index.php` with the `tmpl=component&option=com_jephotogallery&view=category&task=fetchimage&categoryid=` parameters, indicating the injection point.
What the fix does
The provided reference write-up does not include information about a patch or specific remediation steps. Therefore, the advisory does not specify how the vulnerability is fixed. Users are advised to consult the vendor for updated versions or security patches.
Preconditions
- authThe attacker does not require any authentication.
- networkThe attacker can send network requests to the vulnerable server.
- inputThe `categoryid` parameter is vulnerable to SQL injection.
Reproduction
1. Set up Joomla! Component JE Photo Gallery 1.1. 2. Send a GET request to `index.php` with the `com_jephotogallery` component and a crafted `categoryid` parameter containing SQL injection payload, for example: `http://[TARGET]/[PATH]/index.php?tmpl=component&option=com_jephotogallery&view=category&task=fetchimage&categoryid=-29 UNION SELECT (SELECT username,password FROM jos_users),0,0,0,0,0,0,0,0,NULL,0,0-- -`
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.