Security readout for executives and security teams
Plain-English summary
A Joomla add-on called Ek Rishta (version 2.10) has a flaw that lets anyone on the internet tamper with database queries by adjusting a value in the page URL. Without logging in, an attacker can pull sensitive data out of the site's database. Public exploit code has existed since 2018, making opportunistic scanning likely for exposed sites.
Executive priority
Treat as high priority only if a Joomla site running Ek Rishta 2.10 is in the environment; otherwise informational. Any exposed instance risks unauthenticated database disclosure, including personally identifiable data typical of matrimonial sites, warranting prompt containment.
Technical view
Ek Rishta 2.10 for Joomla contains an unauthenticated SQL injection (CWE-89) in the user_detail view via the cid GET parameter. Untrusted input is concatenated into a SQL query, allowing UNION-based or boolean extraction of database contents. CVSS v4.0 is scored 8.8 with network attack vector, no privileges, and no user interaction, per the source bundle.
Likely exposure
Exposure is limited to Joomla sites running Harmis Technology's Ek Rishta matrimonial component at version 2.10 that are internet-reachable. The component is a niche third-party extension, so the overall install base is likely small, but any exposed instance is directly reachable and unauthenticated.
Exploitation context
Public exploit code has been available on Exploit-DB (44869) since 2018, so proof-of-concept access is trivial for attackers. The CVE is not listed in CISA KEV and the sources do not confirm active in-the-wild exploitation, but the age and simplicity make opportunistic scanning realistic.
Researcher notes
Root cause is unsanitized use of the cid parameter in the user_detail SQL query. ExploitDB 44869 documents the injection point and payload shape. No vendor advisory or patched version is cited in the bundle; confirm status directly with Harmis Technology. Consider testing with sqlmap in an authorized lab against a mirrored install rather than production.
Mitigation direction
- Inventory Joomla sites for the Ek Rishta component and identify any at version 2.10.
- Consult the vendor (Harmis Technology / joomlaextensions.co.in) for a fixed release or guidance.
- If no fix is available, disable or uninstall the Ek Rishta component until remediated.
- Place a WAF rule in front of user_detail requests to block SQLi patterns on the cid parameter.
- Restrict database account privileges used by Joomla to the minimum required.
- Rotate database credentials if evidence of prior exploitation is found.
Validation and detection
- Check Joomla Extension Manager for 'Ek Rishta' and record the installed version.
- Review web server logs for GET requests to the user_detail view containing suspicious cid values or SQL syntax.
- Inspect database audit or query logs for unexpected UNION, SLEEP, or information_schema activity.
- Run an authenticated vulnerability scan against the site to confirm the SQLi finding and remediation.
- Verify WAF or mitigation rules block known SQLi patterns without disrupting legitimate traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25348 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-44869CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- Product ReferenceCVE reference, VulnCheck · product
- VulnCheck Advisory: Joomla! Component Ek Rishta 2.10 SQL Injection via user_detailCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.