CVE-2025-40636: Joomla mod_vvisit_counter SQLi Vulnerability

CVE-2025-40636 Overview

CVE-2025-40636 is a SQL injection vulnerability in the Joomla module mod_vvisit_counter version 2.0.4j3. The flaw resides in the handling of the cip_vvisitcounter cookie, which the module reads on every page where it tracks visits. Unauthenticated attackers can inject arbitrary SQL statements through this cookie and retrieve database contents. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote, unauthenticated attackers can extract arbitrary database content from any Joomla site running the affected module by manipulating a cookie value.

Affected Products

Joomla CMS extension mod_vvisit_counter
Version 2.0.4j3
Any Joomla site embedding the module on visitor-tracked endpoints

Discovery Timeline

2025-10-03 - CVE-2025-40636 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40636

Vulnerability Analysis

The mod_vvisit_counter module tracks unique visitors using a client-supplied cookie named cip_vvisitcounter. The module passes the cookie value into a SQL query without proper sanitization or parameterization. An attacker can supply a crafted cookie value that breaks out of the intended query context and appends arbitrary SQL.

Because visit counting executes on every page where the module is rendered, the injection point is reachable on the public-facing front end. No authentication, user interaction, or special privileges are required. The vulnerability scores 9.3 under CVSS 4.0 due to network reach and high impact on confidentiality, integrity, and availability of the backing database.

The EPSS score for this issue is 0.036% (10.8th percentile), reflecting limited public exploit activity at the time of analysis, though the technical barrier to exploitation is low.

Root Cause

The module concatenates the raw cip_vvisitcounter cookie value directly into a SQL statement issued against the Joomla database. The code path neither uses prepared statements nor applies the Joomla database driver's quoting and escaping APIs. Any string accepted by the HTTP cookie parser flows into the query unchanged.

Attack Vector

An attacker sends an HTTP request to any Joomla page that renders the visitor counter and includes a malicious Cookie: cip_vvisitcounter=<payload> header. The payload terminates the original SQL literal and appends statements such as UNION SELECT clauses to exfiltrate data, including Joomla user records, session tokens, and configuration secrets. Blind, time-based, and union-based SQLi techniques are all viable against the unsanitized input.

No proof-of-concept exploit is publicly catalogued for this CVE. Refer to the INCIBE Security Notice for additional technical context.

Detection Methods for CVE-2025-40636

Indicators of Compromise

HTTP requests containing SQL metacharacters (', ", --, UNION, SELECT, SLEEP) inside the cip_vvisitcounter cookie value
Unusually long or URL-encoded cip_vvisitcounter cookie values inconsistent with normal IP-formatted tokens
Joomla database error messages or stack traces referencing the visit counter module in web server logs
Outbound connections or DNS queries originating from the database host shortly after suspicious cookie traffic

Detection Strategies

Inspect web access logs for cookie values that deviate from the expected IP address format used by mod_vvisit_counter
Deploy web application firewall (WAF) rules that flag SQL injection patterns within HTTP cookie headers, not just query strings and POST bodies
Correlate spikes in 500-series responses on Joomla pages with anomalous cookie payloads
Review database query logs for SELECT statements that reference the visit counter table with embedded boolean or UNION clauses

Monitoring Recommendations

Enable verbose logging on the Joomla front-end web server and forward logs to a centralized analytics platform
Alert on repeated requests from a single source that vary the cip_vvisitcounter cookie across requests
Track database response times for visit counter queries to surface time-based blind SQLi attempts

How to Mitigate CVE-2025-40636

Immediate Actions Required

Disable or unpublish the mod_vvisit_counter module in the Joomla administrator interface until a fixed version is confirmed
Block or filter the cip_vvisitcounter cookie at the reverse proxy or WAF layer when its value contains non-IP characters
Rotate Joomla administrator credentials, API tokens, and database passwords if exploitation is suspected
Audit the Joomla #__users table and recent session activity for unauthorized access

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2025-40636. Administrators should monitor the INCIBE Security Notice and the module's distribution channel for an updated release. Until a verified fix exists, treat the module as unsafe to run in production.

Workarounds

Replace mod_vvisit_counter with an actively maintained visitor analytics solution that uses parameterized queries
Add a WAF signature that rejects requests where cip_vvisitcounter fails strict IPv4 or IPv6 validation
Apply database least-privilege so the Joomla application account cannot read sensitive tables outside its scope

bash

# Example ModSecurity rule to drop malformed cip_vvisitcounter cookies
SecRule REQUEST_COOKIES:cip_vvisitcounter "!@rx ^[0-9a-fA-F:.]{1,45}$" \
    "id:1004001,phase:1,deny,status:403,log,\
     msg:'CVE-2025-40636: invalid cip_vvisitcounter cookie format'"