Executive brief
Joomla Payage, a payment processing extension for the Joomla content management system, contains a security flaw that allows unauthorized users to access the underlying database. By sending specially crafted web requests, an attacker can bypass security controls to steal sensitive information, such as customer data or site configuration details. This could lead to significant data breaches and loss of customer trust for organizations using this payment component.
Technical details
A SQL injection vulnerability exists in the Joomla Payage extension (version 2.05 and likely earlier) due to improper neutralization of the 'aid' parameter. The flaw is located within the 'make_payment' task of the component. An unauthenticated remote attacker can exploit this by sending a crafted GET request to index.php with malicious SQL syntax in the 'aid' parameter. Successful exploitation allows for boolean-based blind or time-based blind SQL injection, enabling the attacker to exfiltrate sensitive data from the Joomla database. Public exploit code is available, confirming the vulnerability can be triggered via simple HTTP requests.
Affected products
- Joomla Extensions Payage 2.05 and earlier
Timeline
- 2017-06-03: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: CVE record published and NVD entry created