CVE-2019-25753: Joomla VMap Component SQL Injection Flaw

CVE-2019-25753 Overview

CVE-2019-25753 is an SQL injection vulnerability [CWE-89] in the Joomla! VMap extension version 1.9.6 by WDMTech. The flaw resides in the loadmarker task of the com_vmap component, which fails to sanitize the latlngbound parameter before incorporating it into database queries. Unauthenticated remote attackers can send crafted GET requests to index.php with option=com_vmap&task=loadmarker to inject arbitrary SQL statements. Successful exploitation allows attackers to read sensitive data from the underlying Joomla! database, including user credentials and session information.

Critical Impact
Unauthenticated attackers can extract sensitive database contents from Joomla! sites running the VMap 1.9.6 extension through a single crafted HTTP GET request.

Affected Products

Joomla! VMap extension version 1.9.6 (WDMTech)
Joomla! sites with the com_vmap component installed and enabled
Web applications exposing the loadmarker task endpoint

Discovery Timeline

2026-06-19 - CVE-2019-25753 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25753

Vulnerability Analysis

The VMap component renders interactive maps within Joomla! sites and exposes the loadmarker task to retrieve marker data filtered by geographic bounds. The latlngbound request parameter is passed directly into a backend SQL query without parameterization or input validation. Attackers can break out of the intended query structure and append arbitrary SQL clauses such as UNION SELECT to exfiltrate data from any table accessible to the Joomla! database user.

The vulnerability is reachable without authentication and requires no user interaction. A single HTTP GET request to the public index.php endpoint is sufficient to trigger the flaw. The EPSS score is 0.366% with a percentile of 28.399, reflecting moderate exploitation likelihood given the publicly available Exploit-DB entry.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The loadmarker handler concatenates the latlngbound parameter directly into a raw query string rather than using Joomla!'s prepared statement APIs or the quote() helper provided by the database abstraction layer.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker sends a GET request to index.php?option=com_vmap&task=loadmarker with a malicious payload in the latlngbound parameter. The injected SQL is executed in the context of the Joomla! database user, which typically has full read and write access to the application's schema. Public proof-of-concept code is available through Exploit-DB #46229 and the VulnCheck Advisory on SQL Injection.

Detection Methods for CVE-2019-25753

Indicators of Compromise

HTTP GET requests to index.php containing both option=com_vmap and task=loadmarker parameters
latlngbound parameter values containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences (--, #, /*)
Unusual response sizes or response times for requests to the com_vmap endpoint
Joomla! database error messages appearing in web server or application logs

Detection Strategies

Inspect web server access logs for query strings targeting com_vmap&task=loadmarker with non-numeric or oversized latlngbound values
Deploy web application firewall rules that match SQL injection signatures on requests to the VMap endpoint
Correlate database error events with inbound HTTP requests to identify injection attempts

Monitoring Recommendations

Enable verbose query logging on the Joomla! database and alert on unexpected UNION SELECT statements against the #__users table
Monitor outbound traffic from the web server for unusual data egress following requests to com_vmap
Forward Joomla! and web server logs to a centralized SIEM for retroactive hunting across historical data

How to Mitigate CVE-2019-25753

Immediate Actions Required

Disable or uninstall the VMap component until a patched version is confirmed available from WDMTech
Block public access to index.php?option=com_vmap&task=loadmarker at the reverse proxy or WAF layer
Audit the Joomla! database for unauthorized accounts, modified administrator privileges, and signs of credential theft
Rotate all Joomla! administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

No vendor patch is referenced in the NVD record for CVE-2019-25753. Site operators should consult the WDMTech homepage and the Joomla Extension Directory listing for VMap for any available updates. If no fixed version is published, removing the extension is the recommended remediation.

Workarounds

Restrict access to the com_vmap component to authenticated users via Joomla! access control lists
Deploy WAF signatures that reject requests where latlngbound does not match a strict numeric coordinate pattern
Run the Joomla! database under a least-privilege account that cannot read sensitive tables outside the VMap schema

bash

# Example ModSecurity rule to block SQL keywords in the latlngbound parameter
SecRule ARGS:latlngbound "@rx (?i)(union|select|sleep|benchmark|--|/\*)" \
    "id:1002519,phase:2,deny,status:403,log,\
     msg:'CVE-2019-25753 VMap SQLi attempt blocked'"