Executive brief
vReview is a popular Joomla extension used to add rating and review functionality to websites. A security flaw in version 1.9.11 allows unauthenticated attackers to access the website's underlying database. This could lead to the theft of sensitive information, including user credentials, site configuration data, and database version details.
Technical details
An SQL injection vulnerability exists in the vReview component (v1.9.11) for Joomla due to improper neutralization of the 'cmId' parameter. Unauthenticated attackers can exploit this by sending specially crafted POST requests to the 'editReview' task endpoint. By using URL-encoded SQL UNION statements, an attacker can bypass authentication and execute arbitrary queries to extract sensitive data from the database, such as usernames, password hashes, and system metadata. The vulnerability also appears to affect the 'displayRecords' task via the 'profileid' parameter.
Affected products
- Wdmtech vReview 1.9.11
Timeline
- 2019-01-23: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published