CVE-2019-25756: Joomla! vAccount SQL Injection Vulnerability

CVE-2019-25756 Overview

CVE-2019-25756 is a SQL injection vulnerability [CWE-89] affecting Joomla! Component vAccount version 2.0.2. The flaw exists in the vaccount-dashboard/expense endpoint, where the vid GET parameter is concatenated into a SQL query without sanitization. Unauthenticated attackers can extract database contents, including database version strings and schema names, by sending crafted requests over the network. Public exploit code is documented in Exploit-DB entry 46226.

Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive database contents from affected Joomla! installations through a single crafted HTTP GET request.

Affected Products

Joomla! Component vAccount 2.0.2
Joomla! sites with the vAccount extension installed and enabled
Web applications exposing the vaccount-dashboard/expense endpoint

Discovery Timeline

2026-06-19 - CVE-2019-25756 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25756

Vulnerability Analysis

The vAccount component for Joomla! constructs SQL queries by concatenating user-supplied input from the vid parameter directly into a database statement. The vulnerable code path is reachable through the vaccount-dashboard/expense view without authentication. Attackers append SQL operators and UNION SELECT payloads to the vid value to alter query logic and retrieve arbitrary data from the underlying database.

Because the injection point sits in a financial dashboard component, attackers can read account records, user identifiers, and any other tables accessible to the Joomla! database user. The vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. The EPSS score of 0.366% places likelihood of near-term exploitation in the lower percentile range, but a public proof of concept already exists.

Root Cause

The component fails to apply parameterized queries or input validation to the vid parameter before passing it to the SQL execution layer. No type coercion, allowlist filtering, or prepared statement binding is performed. Joomla!'s database abstraction layer supports prepared statements, but the affected code bypasses these safeguards through direct string concatenation.

Attack Vector

Exploitation requires only network access to the target Joomla! site. An attacker issues an HTTP GET request to a URL of the form /index.php?option=com_vaccount&view=vaccount-dashboard&layout=expense&vid=<payload>. The payload contains SQL syntax such as UNION SELECT version(),database()-- - to extract server fingerprinting data. The vulnerability mechanism is documented in the Exploit-DB #46226 advisory and the VulnCheck Joomla SQL Injection Advisory.

Detection Methods for CVE-2019-25756

Indicators of Compromise

HTTP GET requests targeting vaccount-dashboard with expense layout and a vid parameter containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA.
Web server access logs showing abnormally long vid parameter values or URL-encoded SQL metacharacters (%27, %20, --).
Database error messages or anomalous query latency originating from the vAccount component.

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that flag SQL keywords in the vid query string parameter for com_vaccount requests.
Enable Joomla! database query logging and alert on queries referencing information_schema from the vAccount component context.
Correlate sequential requests to vaccount-dashboard/expense from a single source IP, which indicates automated SQL injection tooling such as sqlmap.

Monitoring Recommendations

Forward Joomla! web server logs and MySQL/MariaDB query logs to a centralized SIEM for inspection.
Baseline normal vid parameter values (typically numeric) and alert on non-numeric input.
Monitor for outbound data transfer spikes from the database tier following requests to the affected endpoint.

How to Mitigate CVE-2019-25756

Immediate Actions Required

Disable or uninstall the vAccount 2.0.2 component from Joomla! installations until a patched release is verified.
Restrict access to the vaccount-dashboard/expense endpoint via WAF rules or .htaccess rewrites that block non-numeric vid values.
Audit the Joomla! database for unauthorized read activity and rotate any credentials or secrets stored in accessible tables.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2019-25756. Administrators should consult the Joomla Extension listing for vAccount and WDM Tech for vendor updates. If no fixed version is available, remove the component from production environments.

Workarounds

Apply WAF input validation rules that enforce an integer-only allowlist on the vid parameter.
Restrict the Joomla! database account's privileges to the minimum required tables, removing access to information_schema where feasible.
Place the affected Joomla! site behind authentication or IP allowlisting until the component is removed or patched.

bash

# Example ModSecurity rule to block SQL keywords in the vid parameter
SecRule ARGS:vid "@rx (?i)(union|select|sleep|information_schema|--|';)" \
    "id:1925756,phase:2,deny,status:403,\
    msg:'CVE-2019-25756 vAccount SQL injection attempt blocked'"