PT-2025-17429 · Joomla · Virtuemart

Adam Wallwork · Published 2025-04-21 · Updated 2025-05-28 · CVE-2025-25228

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VirtueMart component versions 1.0.0 through 4.4.7 for Joomla

Description A SQL injection in the VirtueMart component for Joomla allows authenticated attackers, specifically administrators, to execute arbitrary SQL commands in the product management area in the backend. This issue enables attackers to potentially manipulate or extract sensitive data from the database.

Recommendations For VirtueMart component versions 1.0.0 through 4.4.7, update to a version later than 4.4.7 to resolve the SQL injection issue. As a temporary workaround, consider restricting access to the product management area in the backend to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-25228

Affected Products

Virtuemart

References · 12

• 🔥 https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25228 · Exploit
• https://osv.dev/vulnerability/CVE-2025-25228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25228 · Security Note
• https://twitter.com/cybercronai/status/1914412696012812602 · Twitter Post
• https://t.me/cvedetector/23432 · Telegram Post
• https://t.me/cvenotify/123883 · Telegram Post
• https://t.me/cvetracker/22041 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1914237010589397482 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1914316934067167641 · Twitter Post
• https://t.me/cvenotify/119118 · Telegram Post
• https://twitter.com/CVEnew/status/1914220446163128475 · Twitter Post
• https://virtuemart.net · Note