Joomla! Component JoomCRM 1.1.1 SQL Injection via deal_id
Description
Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and schemas.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Missing input sanitization in the deal_id and association_id parameters allows SQL injection."
Attack vector
An authenticated attacker sends a crafted GET request to `index.php?option=com_joomcrm&view=contacts&format=raw&loc=deal&tmpl=component` with a malicious `deal_id` parameter containing SQL injection payloads [ref_id=1]. Alternatively, a POST request to the events view with a crafted `association_id` parameter can also be used [ref_id=1]. The injected SQL is executed by the database backend, allowing the attacker to extract sensitive information such as database names and table schemas.
Affected code
The vulnerability exists in the Joomla! JoomCRM component version 1.1.1. The `deal_id` parameter in the `index.php?option=com_joomcrm&view=contacts` endpoint is not sanitized before being used in SQL queries, and the `association_id` parameter in the events view is similarly vulnerable.
What the fix does
The advisory does not include a published patch. To remediate the vulnerability, the application must properly sanitize or parameterize the `deal_id` and `association_id` parameters before they are used in SQL queries. Without a fix, an attacker can continue to inject arbitrary SQL through these unsanitized input fields.
Preconditions
- authAttacker must be authenticated to the Joomla! instance
- networkAttacker must be able to send HTTP GET or POST requests to the vulnerable endpoints
Reproduction
Send a GET request to `http://localhost/[PATH]/index.php?option=com_joomcrm&view=contacts&format=raw&loc=deal&tmpl=component&deal_id=31%39%20A%4e%44...` (full URL-encoded payload shown in the exploit) [ref_id=1]. The server returns a 500 error, but the injected SQL has already executed against the database.
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/46122mitreexploit
- www.vulncheck.com/advisories/joomla-component-joomcrm-sql-injection-via-deal-idmitrethird-party-advisory
- joomboost.commitreproduct
- extensions.joomla.org/extensions/extension/marketing/crm/joomcrm/mitreproduct
News mentions
0No linked articles in our index yet.