CVE-2019-25753: Joomla! Component VMap 1.9.6 SQL Injection via loadmarker
Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=comvmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla! Component VMap 1.9.6from your environment.Uninstall the VMap component from the affected Joomla installation if it is not required.
- Configuration
Disable the com_vmap component in the Joomla administrator interface to prevent access to its functionality (including the loadmarker task) until a secure update is available.
Joomla! Component VMap 1.9.6 enabled = false - Compensating control
Create a web application firewall (WAF) or web server rule to block or challenge requests to index.php that include the parameters option=com_vmap&task=loadmarker or that contain the latlngbound parameter, and block common SQL injection payload patterns targeting those parameters.
- Operational
Audit web and database logs for requests to option=com_vmap&task=loadmarker and for suspicious SQL query activity or data exfiltration. If compromise is suspected, follow incident response procedures and rotate any potentially exposed credentials or secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25753?
CVE-2019-25753 has a high severity rating of 8.8.
How do I fix CVE-2019-25753?
To fix CVE-2019-25753, upgrade to the latest version of Joomla! Component VMap.
What type of vulnerability is CVE-2019-25753?
CVE-2019-25753 is an SQL injection vulnerability.
Who can be affected by CVE-2019-25753?
CVE-2019-25753 can be exploited by unauthenticated attackers.
What parameters are exploited in CVE-2019-25753?
CVE-2019-25753 exploits the latlngbound parameter in GET requests.