p PatchFirst

CVE-2025-25226

CVE-2025-25226 · [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.

CVSS 9.8 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • joomla! framework

    Versions
    • 1.0.0-2.1.1: Affected
    • 3.0.0-3.3.1: Affected

    No fix published

  • joomla/database Packagist

    Versions
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.4.0

    Update to 3.4.0

  • joomla/database Packagist

    Versions
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 2.0.0
    • 2.0.0-beta
    • 2.0.0-beta2
    • 2.0.0-beta3
    • 2.0.0-beta4
    • 2.0.0-rc
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 2.2.0

    Update to 2.2.0

Original sources

Check your server →