PT-2025-25253 · Joomla · Media Gallery

Kamil Szczurowski + 1 · Published 2025-06-11 · Updated 2025-06-12 · CVE-2025-32466

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions RSMediaGallery! component versions 1.7.4 through 2.1.7

Description A SQL injection issue was discovered in the dashboard component of the RSMediaGallery! component for Joomla. The problem arises because user-supplied input is not properly sanitized before being stored and rendered. This allows an attacker to inject malicious code into text fields or other input points, which is then executed in the browser of any user who interacts with the crafted text in the dashboard.

Recommendations For versions 1.7.4 through 2.1.7, update to a version that includes the fix for this issue to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the dashboard component to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-32466

Affected Products

Media Gallery

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-32466 · Security Note
• https://t.me/cvetracker/26053 · Telegram Post
• https://twitter.com/threatsbank/status/1933132424784863384 · Twitter Post
• https://t.me/cvenotify/125444 · Telegram Post
• https://rsjoomla.com · Note
• https://twitter.com/CVEnew/status/1932882533362102459 · Twitter Post