Executive brief
HDW Player is a video player extension for the Joomla content management system. A security flaw in its search feature allows unauthorized individuals to access sensitive information from the website's database. This could lead to the exposure of private video data or other internal site information, potentially damaging the organization's reputation and data privacy.
Technical details
An SQL injection vulnerability exists in the HDW Player (com_hdwplayer) extension for Joomla, specifically within the HdwplayerModelSearch::getsearch function in components/com_hdwplayer/models/search.php. The application fails to properly sanitize the 'hdwplayersearch' POST parameter before incorporating it into a SQL query. An unauthenticated remote attacker can exploit this by sending crafted POST requests to execute arbitrary SQL commands. This allows for the extraction of sensitive data from the #__hdwplayer_videos table and potentially other database tables. The vulnerability was publicly disclosed with proof-of-concept exploit code in 2020.
Affected products
- HDW Player com_hdwplayer 4.2 and earlier
Timeline
- 2020-03-23: disclosed: Exploit-DB entry published with PoC
- 2026-05-13: advisory: NVD/VulnCheck advisory published