CVE-2018-25380: Joomla eXtroForms SQLi Vulnerability

CVE-2018-25380 Overview

CVE-2018-25380 is an SQL injection vulnerability [CWE-89] affecting Joomla Component eXtroForms version 2.1.5. The flaw exists in the extroformfield view, where the filter_type_id, filter_pid_id, and filter_search parameters fail to sanitize user-supplied input before passing values into SQL queries. Authenticated attackers can submit crafted POST requests containing malicious SQL payloads to extract sensitive database records and server data. The vulnerability requires low-privilege authentication but no user interaction, making it accessible to any account that can reach the affected endpoint.

Critical Impact

Authenticated attackers can execute arbitrary SQL commands against the backend database, exposing credentials, user data, and other confidential records stored by the Joomla installation.

Affected Products

• Joomla Component eXtroForms 2.1.5
• Joomla installations using the eXtroForms contact form extension
• Web applications exposing the extroformfield view to authenticated users

Discovery Timeline

• 2026-05-25 - CVE-2018-25380 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25380

Vulnerability Analysis

The vulnerability resides in how eXtroForms 2.1.5 processes filter parameters within the extroformfield view. The component accepts the filter_type_id, filter_pid_id, and filter_search POST parameters and concatenates them directly into SQL statements. Because no parameterization or input validation occurs, attackers can break out of the intended query context and append arbitrary SQL clauses.

Exploitation grants read access to data the database user can reach, including Joomla configuration tables, session records, and password hashes from #__users. Attackers commonly chain UNION SELECT payloads or boolean-based blind techniques to enumerate schema details and exfiltrate records column by column.

Further technical details and proof-of-concept payloads are documented in the Exploit-DB #45472 entry and the VulnCheck Joomla SQL Injection Advisory.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The eXtroForms component constructs SQL queries by interpolating filter parameter values directly from the HTTP request body. Without prepared statements or strict type casting, characters such as single quotes, parentheses, and SQL keywords pass through unchanged into the query string.

Attack Vector

An attacker authenticates to the Joomla site with any valid account, then issues a POST request to the extroformfield view. The request body includes one of the vulnerable filter parameters carrying a SQL payload such as a UNION SELECT clause targeting the #__users table. The server executes the manipulated query and returns data in the response body or through timing differences in blind exploitation scenarios.

The vulnerability is exploitable over the network and requires no user interaction. Successful exploitation primarily compromises data confidentiality, though attackers can leverage extracted administrator credentials to escalate access within the Joomla environment.

Detection Methods for CVE-2018-25380

Indicators of Compromise

• POST requests to index.php referencing the extroformfield view with SQL metacharacters such as single quotes, UNION, SELECT, or SLEEP( in the filter_type_id, filter_pid_id, or filter_search parameters.
• Unusual web server response sizes or latency spikes correlated with requests to the eXtroForms endpoint.
• Database query logs containing UNION SELECT statements against #__users or other Joomla core tables originating from the eXtroForms component.

Detection Strategies

• Inspect web access logs for POST bodies targeting the extroformfield view and flag values containing SQL syntax.
• Deploy Web Application Firewall (WAF) rules that detect SQL injection patterns in the three vulnerable filter parameters.
• Correlate authenticated user sessions issuing repeated filter requests with abnormal database query volume.

Monitoring Recommendations

• Enable Joomla database query logging and alert on queries that contain attacker-controlled tautologies such as OR 1=1 or stacked UNION clauses.
• Monitor authentication logs for low-privilege accounts performing automated requests against form components.
• Review outbound data transfer baselines for the Joomla host to identify bulk exfiltration following injection activity.

How to Mitigate CVE-2018-25380

Immediate Actions Required

• Restrict access to the eXtroForms extroformfield view at the web server or reverse proxy layer until a patched component is available.
• Audit all Joomla user accounts and force password resets if exploitation is suspected, prioritizing administrator credentials.
• Apply Web Application Firewall signatures that block SQL injection patterns in the filter_type_id, filter_pid_id, and filter_search parameters.

Patch Information

No vendor patch reference is included in the NVD entry for CVE-2018-25380. Administrators should consult the Joomla Extension Contact Forms listing and the Extro Media Platform site for current release information. If no fixed version is available, remove the eXtroForms 2.1.5 extension and replace it with a maintained contact form component.

Workarounds

• Uninstall eXtroForms 2.1.5 if business requirements allow, and migrate to an actively maintained Joomla contact form extension.
• Enforce strict input validation at the reverse proxy by rejecting requests where filter parameters contain non-numeric characters when integers are expected.
• Apply least-privilege principles to the Joomla database user so injection attempts cannot read tables outside the application schema.

# Example ModSecurity rule blocking SQL syntax in vulnerable filter parameters
SecRule ARGS:filter_type_id|ARGS:filter_pid_id|ARGS:filter_search \
  "@rx (?i)(union(\s)+select|sleep\(|or\s+1=1|--|/\*)" \
  "id:1002518,phase:2,deny,status:403,msg:'CVE-2018-25380 eXtroForms SQLi attempt'"