CVE-2019-25756: Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard
Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or restrict access to the vaccount-dashboard/expense endpoint (path: /vaccount-dashboard/expense). Implement a WAF or webserver rule to deny or challenge GET requests that include the vid parameter containing SQL meta-characters (quotes, comment markers, SQL keywords) or to require authentication for that endpoint until a vendor fix is applied.
- Operational
Review webserver and application logs for requests to /vaccount-dashboard/expense and inspect vid parameter values for evidence of SQL injection (e.g., injected SQL keywords, quotes, comment tokens). If suspicious activity or compromise is detected, rotate database credentials used by vAccount and any impacted application accounts, and follow incident response procedures.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25756?
The severity of CVE-2019-25756 is rated as high with a score of 8.2.
How do I fix CVE-2019-25756?
To fix CVE-2019-25756, it is recommended to update Joomla! Component vAccount to the latest version that addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2019-25756?
CVE-2019-25756 is classified as an SQL injection vulnerability.
Who is affected by CVE-2019-25756?
CVE-2019-25756 affects Joomla! Component vAccount version 2.0.2.
What impact can CVE-2019-25756 have?
CVE-2019-25756 can allow unauthenticated attackers to execute arbitrary SQL queries, which can compromise sensitive data.