Executive brief
vBizz is a business management extension for Joomla used for CRM, accounting, and project management. A security flaw allows logged-in users to run unauthorized database commands. This could allow an attacker to steal sensitive business information, including financial records, employee data, and database configuration details.
Technical details
An SQL injection vulnerability exists in the Wdmtech vBizz component version 1.0.7 for Joomla. The flaw is located within the employee management interface, specifically in the handling of the 'payid' array parameter during POST requests. An authenticated attacker with low-level privileges can submit crafted array values containing malicious SQL commands. This allows for the extraction of sensitive information from the database, such as database names and version information, using functions like EXTRACTVALUE. The vulnerability is tracked as CWE-89.
Affected products
- Wdmtech vBizz 1.0.7
Timeline
- 2019-01-23: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: NVD/VulnCheck advisory published