Executive brief
JoomRecipe is a recipe management extension for the Joomla content management system. A security flaw in this component allows remote attackers to access or modify sensitive information stored in the website's database without needing a password. This could lead to the exposure of user data or unauthorized changes to the website's content.
Technical details
A SQL injection vulnerability exists in the JoomRecipe component (version 1.0.3) for Joomla. The flaw is located in the handling of the 'category' parameter within the 'all-recipes' endpoint. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request containing malicious SQL payloads in the URL path segment. Successful exploitation allows the attacker to bypass authentication, extract sensitive data from the database, or potentially modify database records. The vulnerability is tracked as CWE-89 and has been publicly documented with exploit examples.
Affected products
- Joomboost JoomRecipe 1.0.3
Timeline
- 2017-06-15: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: NVD and VulnCheck published formal advisory details