PT-2025-6942 · Joomla · Js Jobs

Adam Wallwork · Published 2025-02-15 · Updated 2025-02-21 · CVE-2025-22209

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin versions 1.1.5 through 1.4.3 for Joomla

Description: A SQL injection issue allows authenticated attackers, with administrator privileges, to execute arbitrary SQL commands via the searchpaymentstatus parameter in the Employer Payment History search feature.

Recommendations: For JS Jobs plugin versions 1.1.5 through 1.4.3, consider disabling the Employer Payment History search feature until a patch is available to prevent exploitation of the SQL injection vulnerability. Restrict access to the searchpaymentstatus parameter to minimize the risk of arbitrary SQL command execution.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-22209

Affected Products

Js Jobs

References · 9

• 🔥 https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22209 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-22209 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22209 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1890696961499513243 · Twitter Post
• https://t.me/cvedetector/18167 · Telegram Post
• https://t.me/cvenotify/111992 · Telegram Post
• https://joomsky.com/js-jobs-joomla · Note
• https://twitter.com/CVEnew/status/1890685024888127795 · Twitter Post
• https://t.me/cvenotify/111491 · Telegram Post