CVE-2025-25226: Joomla Database Package SQL Injection Vulnerability
Summary
CVE-2025-25226: Joomla Framework Database Package Vulnerable to SQL Injection. Affects joomla/database across 2 version ranges.
>= 1.0.0, < 2.2.0
>= 3.0.0, < 3.4.0
Fixed in 2.2.0 or 3.4.0, depending on the release line you run. How to fix ↓
Also tracked for
- joomla · Bitnami
The same CVE-2025-25226 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Joomla Database Package is a core component of the Joomla content management system, providing essential database interaction functionalities. It allows developers to perform various database operations, including querying, updating, and managing database connections. The package is widely used in Joomla applications, making it critical for maintaining data integrity and security. However, a vulnerability has been identified in the quoteNameStr method, which could potentially lead to SQL injection if misused in extended classes.
Vulnerability Detail
The vulnerability arises from improper handling of identifiers in the quoteNameStr method of the Joomla Database Package. This protected method does not have direct usages in the original packages of Joomla 2.x or 3.x branches, meaning it cannot be exploited in its default state. However, if developers extend the affected class and utilize the vulnerable method, they may inadvertently expose their applications to SQL injection attacks. This could allow attackers to manipulate database queries, leading to unauthorized data access or corruption.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.2.02.2.0composer require joomla/database:2.2.0 -
>= 3.0.0, < 3.4.03.4.0composer require joomla/database:3.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers should avoid using the quoteNameStr method in any extended classes until the package is updated. Instead, consider using alternative methods for handling database identifiers that do not expose the application to SQL injection risks.
Conclusion
The Joomla Database Package has a moderate SQL injection vulnerability due to improper handling of identifiers in the quoteNameStr method. While the original package is not directly exploitable, developers extending the class must take caution. Updating to the latest patched versions is crucial to maintaining application security.
See every vulnerability recorded for joomla/database →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data that they are not normally able to retrieve.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the vulnerable method in any extended classes as a temporary measure until you can apply the patch.
No, the vulnerability is only present in installations that extend the affected class and use the vulnerable method. Default installations of Joomla are not directly exploitable.
If exploited, this vulnerability could allow attackers to execute arbitrary SQL queries, potentially leading to data breaches, data loss, or unauthorized access to sensitive information.
