CVE-2019-25755: Joomla vReview SQL Injection Vulnerability

CVE-2019-25755 Overview

CVE-2019-25755 is an SQL injection vulnerability [CWE-89] affecting the Joomla extension vReview version 1.9.11, developed by WDM Tech. Unauthenticated attackers can inject arbitrary SQL through the cmId parameter in POST requests sent to the editReview task endpoint. Successful exploitation allows extraction of database contents, including usernames, password hashes, and database version information, via UNION-based payloads. The flaw requires no authentication, no user interaction, and is reachable over the network, making it suitable for opportunistic mass scanning against Joomla sites that ship the vReview ratings and reviews extension.

Critical Impact
Unauthenticated remote attackers can read arbitrary data from the backend database, including Joomla user credentials, by submitting crafted POST requests to the vReview editReview endpoint.

Affected Products

Joomla Component vReview 1.9.11 (WDM Tech)
Joomla sites with the vReview ratings and reviews extension installed
The editReview task handler processing the cmId parameter

Discovery Timeline

2026-06-19 - CVE-2019-25755 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25755

Vulnerability Analysis

The vulnerability resides in the vReview component's handling of the cmId request parameter routed to the editReview task. The component concatenates the parameter value directly into an SQL query without parameterization or input sanitization. Attackers submit a POST request containing a URL-encoded SQL UNION SELECT payload in cmId, causing the database to return attacker-chosen columns alongside legitimate result rows. Because the endpoint accepts unauthenticated requests, exploitation requires only network reachability to the vulnerable Joomla site. The classification falls under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is the absence of prepared statements or parameter binding when constructing the SQL query for the editReview task. The cmId value flows from untrusted HTTP input directly into a dynamic query, allowing operators such as UNION to alter query structure. Joomla's database abstraction layer supports parameter binding, but the vReview component bypasses these safeguards.

Attack Vector

An attacker sends a POST request to the Joomla index endpoint with task=editReview and a malicious cmId value containing a URL-encoded UNION query. The server executes the modified statement and returns data such as the Joomla #__users table contents or output from version(). No credentials or prior interaction are required, and the attack travels over standard HTTP or HTTPS. See the Exploit-DB #46227 and VulnCheck Joomla vReview Advisory entries for the published proof-of-concept request structure.

Detection Methods for CVE-2019-25755

Indicators of Compromise

POST requests to Joomla endpoints containing task=editReview combined with cmId parameter values that include URL-encoded UNION, SELECT, or 0x sequences.
Web server access logs showing unusually long cmId values, hexadecimal payloads, or repeated requests from a single source enumerating database rows.
Database query logs containing UNION SELECT statements originating from the vReview component's PHP context.

Detection Strategies

Deploy web application firewall signatures that flag SQL meta-characters and UNION SELECT patterns inside the cmId POST parameter.
Enable Joomla and PHP error logging to capture malformed SQL statements that fail mid-injection during attacker reconnaissance.
Correlate spikes in editReview task requests with response size anomalies, which often indicate data exfiltration via UNION-based extraction.

Monitoring Recommendations

Monitor outbound database connections from the Joomla host for queries that reference information_schema, users, or version() immediately following an editReview request.
Alert on web sessions that issue multiple POST requests to the vReview endpoint within short time windows from the same IP.
Forward Joomla and database logs to a centralized analytics platform for retrospective hunting against the cmId parameter pattern.

How to Mitigate CVE-2019-25755

Immediate Actions Required

Disable or uninstall the vReview 1.9.11 extension on any Joomla site where a fixed version is not available from WDM Tech.
Restrict access to the Joomla front-end editReview task using web server access controls or WAF rules until the component is removed or patched.
Audit the Joomla #__users table for unauthorized modifications and rotate administrator credentials if exposure is suspected.

Patch Information

No vendor patch has been confirmed in the available references. Operators should consult the WDM Tech homepage and the Joomla Extensions Directory vReview listing for any updated release. Until a fixed build is published, removal of the component is the most reliable remediation.

Workarounds

Block POST requests to the Joomla index where task=editReview is present and cmId contains non-numeric characters using a WAF or reverse proxy rule.
Apply database-layer least privilege so the Joomla account cannot read sensitive tables outside the vReview schema.
Place the affected Joomla site behind authentication or IP allow-listing if the extension cannot be removed immediately.

bash

# Example ModSecurity rule to block UNION-based injection in cmId
SecRule ARGS:cmId "@rx (?i)(union(\s|\+|/\*)+select|0x[0-9a-f]{4,}|information_schema)" \
    "id:1925755,phase:2,deny,status:403,log,\
    msg:'CVE-2019-25755 vReview cmId SQLi attempt'"