Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard
Description
Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Missing input sanitization in the `vid` parameter allows unauthenticated SQL injection."
Attack vector
An unauthenticated attacker sends a GET request to the `vaccount-dashboard/expense` endpoint with a crafted `vid` parameter containing SQL injection payloads. The payload in the exploit URL decodes to `18 AND EXTRACTVALUE(22,CONCAT(0x5c,version(),(SELECT (ELT(1=1,1))),database()))-- X`, which uses `EXTRACTVALUE` to trigger an error-based SQL injection that leaks the database version and name. No authentication or special privileges are required, and the attack is performed over HTTP. [ref_id=1]
Affected code
The vulnerability resides in the Joomla! Component vAccount version 2.0.2. The `vid` parameter in the `vaccount-dashboard/expense` endpoint is directly concatenated into SQL queries without sanitization, allowing unauthenticated SQL injection.
What the fix does
The advisory does not include a patch or vendor fix. To remediate, the application must use parameterized queries or prepared statements for the `vid` parameter in the `vaccount-dashboard/expense` endpoint, ensuring user input is never concatenated directly into SQL statements. Input validation and proper escaping should also be applied.
Preconditions
- configThe Joomla! vAccount component 2.0.2 must be installed and the vaccount-dashboard/expense endpoint must be accessible.
- authNo authentication is required; the attacker can be unauthenticated.
- networkThe attacker must be able to send HTTP GET requests to the target server.
- inputThe attacker supplies a malicious SQL payload in the vid query parameter.
Reproduction
Send a GET request to `http://TARGET/[PATH]/vaccount-dashboard/expense?vid=18%20%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32,%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29,%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58` with appropriate Host and Cookie headers. The server returns a 500 error containing the database version and database name in the response body. [ref_id=1]
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/46226mitreexploit
- www.vulncheck.com/advisories/joomla-component-vaccount-sql-injection-via-vaccount-dashboardmitrethird-party-advisory
- wdmtech.commitreproduct
- extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/mitreproduct
News mentions
0No linked articles in our index yet.