{"id":"CVE-2018-25330","state":"PUBLISHED","title":"Joomla! EkRishta 2.10 Persistent XSS and SQL Injection","description":"Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.","publishedAt":"2026-05-17T12:11:35.396Z","updatedAt":"2026-05-18T20:07:39.291Z","severity":{"score":8.8,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Joomlaextensions Joomla! extension EkRishta"],"affected":[{"vendor":"Joomlaextensions","product":"Joomla! extension EkRishta","versions":[{"version":"2.10","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/44660","https://www.joomlaextensions.co.in/","https://extensions.joomla.org/extensions/extension/living/dating-a-relationships/ek-rishta/","https://www.vulncheck.com/advisories/joomla-ekrishta-persistent-xss-and-sql-injection"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:44:44.295Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2018/25xxx/CVE-2018-25330.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2018-25330","state":"PUBLISHED","datePublished":"2026-05-17T12:11:35.396Z","dateUpdated":"2026-05-18T20:07:39.291Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-05-17T11:44:19.182Z"},"containers":{"cna":{"title":"Joomla! EkRishta 2.10 Persistent XSS and SQL Injection","descriptions":[{"lang":"en","value":"Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries."}],"affected":[{"vendor":"Joomlaextensions","product":"Joomla! extension EkRishta","versions":[{"version":"2.10","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/44660","name":"ExploitDB-44660","tags":["exploit"]},{"url":"https://www.joomlaextensions.co.in/","name":"Official Product Homepage","tags":["product"]},{"url":"https://extensions.joomla.org/extensions/extension/living/dating-a-relationships/ek-rishta/","name":"Product Reference","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/joomla-ekrishta-persistent-xss-and-sql-injection","name":"VulnCheck Advisory: Joomla! EkRishta 2.10 Persistent XSS and SQL Injection","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.8,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-17T12:11:35.396Z"},"datePublic":"2018-05-18T00:00:00.000Z","credits":[{"lang":"en","value":"Sina Kheirkhah || (Sina.For.Sec@gmail.com)","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-18T20:07:16.380047Z","id":"CVE-2018-25330","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-18T20:07:39.291Z"}}]}}}