CVE-2018-25348: Joomla Ek Rishta SQLi Vulnerability

CVE-2018-25348 Overview

CVE-2018-25348 is a SQL injection vulnerability in the Joomla! Ek Rishta component version 2.10. The flaw resides in the user_detail view, where the cid parameter is passed directly into a backend database query without proper sanitization. Unauthenticated attackers can send crafted GET requests to inject SQL syntax and extract data from the underlying database. The issue is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Unauthenticated remote attackers can exfiltrate sensitive data from Joomla! sites running the Ek Rishta 2.10 matrimonial component by injecting SQL into the cid parameter.

Affected Products

• Joomla! Ek Rishta Component version 2.10
• Joomla! sites that have installed the Ek Rishta matrimonial extension
• Deployments exposing the user_detail view to unauthenticated users

Discovery Timeline

• 2026-05-23 - CVE-2018-25348 published to the National Vulnerability Database
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25348

Vulnerability Analysis

The Ek Rishta component is a Joomla! extension that provides matrimonial profile functionality. The component accepts a cid parameter through the user_detail view to identify which user record to display. The application concatenates this parameter into a SQL query without parameterization or input validation.

An attacker can append SQL operators such as UNION SELECT or boolean conditions to the cid value. The database engine then executes the injected statements alongside the intended query. This allows extraction of credentials, session tokens, and personally identifiable information stored in the Joomla! database.

Because the vulnerable view does not require authentication, attackers can exploit it directly over the network. The flaw maps to [CWE-89] and reflects the same class of injection issue documented in the Exploit-DB #44869 entry.

Root Cause

The root cause is the absence of prepared statements or input sanitization on the cid request parameter. The component builds SQL queries through string concatenation, treating attacker-controlled input as trusted query syntax.

Attack Vector

Exploitation requires a single HTTP GET request to the Joomla! site hosting the vulnerable component. The attacker targets the user_detail view and supplies SQL payload syntax through the cid parameter. No credentials, user interaction, or prior access are needed. Refer to the VulnCheck advisory for EK Rishta for additional technical details.

Detection Methods for CVE-2018-25348

Indicators of Compromise

• HTTP GET requests to the Joomla! site containing view=user_detail with non-numeric or SQL metacharacters in the cid parameter
• Web server logs showing payload fragments such as UNION, SELECT, SLEEP(, --, or encoded variants in the cid value
• Database error messages referencing syntax issues originating from Ek Rishta SQL queries
• Unusual outbound data volume from the web application following requests to user_detail

Detection Strategies

• Inspect Joomla! access logs for requests matching the pattern index.php?option=com_ekrishta&view=user_detail&cid= followed by suspicious characters
• Deploy web application firewall (WAF) rules that flag SQL keywords in query string parameters
• Correlate web request anomalies with database query telemetry to identify injection attempts

Monitoring Recommendations

• Enable Joomla! query logging and database audit logs on the MySQL or MariaDB backend
• Forward web server, WAF, and database logs to a centralized log analytics platform for correlation
• Alert on repeated 500-series responses from the user_detail endpoint, which often indicate injection probing

How to Mitigate CVE-2018-25348

Immediate Actions Required

• Disable or uninstall the Ek Rishta 2.10 component from any Joomla! installation where it is present
• Restrict access to the user_detail view at the web server or WAF layer until the component is removed
• Audit the Joomla! database for evidence of unauthorized SELECT activity and rotate exposed credentials

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2018-25348. Administrators should verify the current status of the extension through the Joomla! Extensions Directory listing for Ek Rishta and the vendor resource page. If an updated version is not available, remove the component.

Workarounds

• Block requests containing SQL syntax in the cid parameter using a WAF rule targeting com_ekrishta
• Apply the principle of least privilege to the Joomla! database account, restricting it to only the tables required by the site
• Replace the Ek Rishta component with a maintained alternative that uses parameterized queries

# Example WAF rule (ModSecurity) to block SQL metacharacters in cid
SecRule ARGS:cid "@rx (?i)(union|select|sleep\(|--|;|/\*)" \
    "id:1002518,phase:2,deny,status:403,msg:'CVE-2018-25348 Ek Rishta SQLi attempt'"