Executive brief
JoomCRM is a customer relationship management tool for Joomla websites used to manage sales leads, deals, and customer data. A security flaw allows logged-in users to run unauthorized database commands, which could lead to the theft of sensitive business information, customer records, and website configuration details. This could result in a significant data breach or loss of proprietary sales information.
Technical details
An SQL injection vulnerability exists in the JoomCRM component (version 1.1.1) for Joomla due to improper neutralization of the 'deal_id' parameter. The flaw is reachable via GET requests to index.php when the 'option' is set to 'com_joomcrm' and 'view' is set to 'contacts'. An authenticated attacker with low privileges can exploit this to execute arbitrary SQL commands against the backend database. This allows for the extraction of sensitive information, including database schemas, table names, and stored user or business data. While the advisory focuses on version 1.1.1, later versions may be available from the vendor.
Affected products
- Joomboost JoomCRM 1.1.1
Timeline
- 2019-01-11: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: CVE published and NVD record created