CVE-2025-54474: DJ-Classifieds for Joomla SQLi Flaw

CVE-2025-54474 Overview

CVE-2025-54474 is a SQL injection vulnerability [CWE-89] affecting the DJ-Classifieds component versions 3.9.2 through 3.10.1 for Joomla. The flaw allows privileged users to execute arbitrary SQL commands against the underlying database. The vulnerability requires authenticated access with elevated privileges but can be exploited remotely over the network without user interaction.

Successful exploitation compromises database confidentiality and integrity, enabling attackers to read sensitive data, modify records, or escalate access within the Joomla application.

Critical Impact
Authenticated attackers with high privileges can execute arbitrary SQL commands against the Joomla database, exposing classified listings, user data, and administrative records.

Affected Products

DJ-Classifieds component for Joomla, version 3.9.2
DJ-Classifieds component for Joomla, versions 3.9.3 through 3.10.0
DJ-Classifieds component for Joomla, version 3.10.1

Discovery Timeline

2025-08-15 - CVE-2025-54474 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54474

Vulnerability Analysis

The vulnerability resides in the DJ-Classifieds extension, a third-party Joomla component used for building classified advertisement sites. Affected versions fail to properly sanitize user-supplied input before incorporating it into SQL queries. An authenticated user with elevated privileges can inject malicious SQL payloads through parameters processed by the component.

Because the attack vector is the network and no user interaction is required, an authenticated administrator session is sufficient to weaponize the issue. The vulnerability impacts confidentiality and integrity of the database, though availability is not directly affected according to the published CVSS metrics.

The EPSS score is 0.298% with a percentile of 21.255, indicating a lower probability of near-term exploitation activity. However, third-party Joomla components remain a frequent target for opportunistic attackers once authenticated access is obtained.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The component concatenates untrusted input into SQL statements rather than using parameterized queries or prepared statements provided by the Joomla database API. This allows attacker-controlled values to alter query logic and execute attacker-defined SQL.

Attack Vector

An attacker authenticated to the Joomla backend with high privileges submits crafted input through a vulnerable parameter exposed by the DJ-Classifieds component. The injected SQL executes within the application's database context, returning data or modifying records. No social engineering or victim interaction is required.

No public proof-of-concept exploit or vendor technical write-up has been published. Refer to the DJ Extensions Security Information page for vendor advisories and remediation guidance.

Detection Methods for CVE-2025-54474

Indicators of Compromise

Unexpected SQL syntax characters such as ', --, UNION SELECT, or OR 1=1 in Joomla web server access logs targeting index.php?option=com_djclassifieds endpoints
Unusual database queries originating from the Joomla web application user, particularly long or malformed SELECT statements
Administrative session activity from unfamiliar IP addresses preceding anomalous database query patterns

Detection Strategies

Inspect web server logs for query strings referencing DJ-Classifieds component parameters with embedded SQL metacharacters or encoded variants
Enable MySQL or MariaDB general query logging temporarily to identify malformed or unexpected statements issued by the Joomla database user
Correlate authenticated administrator logins with subsequent database errors logged in error.log or Joomla's logging directory

Monitoring Recommendations

Deploy a web application firewall (WAF) with rules tuned for SQL injection patterns targeting Joomla component URLs
Alert on privilege escalation events or unexpected modifications to the Joomla #__users table
Monitor outbound network traffic from the Joomla server for signs of data exfiltration following authenticated sessions

How to Mitigate CVE-2025-54474

Immediate Actions Required

Identify all Joomla installations running DJ-Classifieds versions 3.9.2 through 3.10.1 and prioritize upgrading to a fixed release published by DJ-Extensions
Review administrator and privileged user accounts, removing unused accounts and rotating credentials for any account that may have been compromised
Audit recent database activity and backups for signs of unauthorized modification or data access

Patch Information

Review the DJ Extensions Security Information page for the vendor's official advisory and the patched component release. Apply the update through the Joomla extensions manager and verify the installed version after upgrade.

Workarounds

Restrict access to the Joomla administrator interface using IP allow-listing at the web server or firewall layer
Enforce multi-factor authentication for all privileged Joomla accounts to reduce the risk of credential abuse
Deploy WAF signatures that block SQL injection payloads against com_djclassifieds URLs until the patch is applied

bash

# Example: restrict Joomla administrator access by IP using Apache
<Location /administrator>
    Require ip 203.0.113.0/24
</Location>