Executive brief
The Extra Search component for Joomla, which provides advanced search functionality for websites, contains a security flaw that allows unauthorized users to access the underlying database. By sending a specially crafted web request, an attacker can bypass security controls to view sensitive information stored in the site's database. This could lead to the exposure of user credentials, personal data, or proprietary site configuration details.
Technical details
An SQL injection vulnerability exists in the Joomlaboat Extra Search component (com_extrasearch) version 2.2.8 for Joomla. The flaw is located within the 'establename' parameter, which fails to properly neutralize special elements used in SQL commands. An unauthenticated remote attacker can exploit this by sending a crafted GET request to index.php with malicious SQL code embedded in the affected parameter. Successful exploitation allows the attacker to manipulate database queries and extract sensitive information from the database. Public exploit code has been available since 2017.
Affected products
- Joomlaboat Extra Search 2.2.8
Timeline
- 2017-03-21: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published