Executive brief
NextGen Editor is a content editing extension for the Joomla website management system. A security flaw in this extension allows unauthorized individuals to run malicious database commands on the website. This could lead to the theft of sensitive information, such as user credentials or private site data, without requiring any login access.
Technical details
An SQL injection vulnerability exists in the NextGen Editor extension (version 2.1.0) for Joomla. The flaw is located in the 'plname' parameter within the 'config' view of the 'com_nge' component. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request to index.php (e.g., index.php?option=com_nge&view=config&plname=[SQL]). Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to the extraction of sensitive database information. The extension has reportedly been unpublished from the Joomla Extension Directory.
Affected products
- nextgeneditor NextGen Editor 2.1.0
Timeline
- 2017-12-19: disclosed: Original exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published