« Volver al listado

CVE-2025-22211

Estado: AnalizadaBaja (3.4)—

A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Webdesigner-profi — Joomshopping

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22211",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22211",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-03T15:58:35.315110Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.4,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@joomla.org",
      "affectedData": [
        {
          "vendor": "webdesigner-profi.de",
          "product": "JoomShopping component for Joomla",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-1.4.3"
            }
          ],
          "packageName": "com_jshopping",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-25T22:15:15.200",
  "references": [
    {
      "url": "https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22211",
      "tags": [
        "Exploit"
      ],
      "source": "security@joomla.org"
    },
    {
      "url": "https://www.webdesigner-profi.de/",
      "tags": [
        "Product"
      ],
      "source": "security@joomla.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@joomla.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en el componente de JoomShopping versiones 1.0.0-1.4.3 para Joomla permite a los atacantes autenticados (administradores) ejecutar comandos SQL arbitrarios en el área de gestión del país del backend."
    }
  ],
  "lastModified": "2026-06-17T08:45:36.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webdesigner-profi:joomshopping:*:*:*:*:*:joomla\\!:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FDBBA7A-95E7-4BB8-9047-F0AFF984299E",
              "versionEndIncluding": "1.4.3",
              "versionStartIncluding": "1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@joomla.org"
}