SQL Injection in Joomla eXtroForms Component Authentication

Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the filter_type_id, filter_pid_id, and filter_search parameters. Attackers can submit POST requests to the extroformfield view with malicious SQL payloads to extract sensitive database information and server data.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2018-25380 is a SQL injection vulnerability in the Joomla eXtroForms component version 2.1.5 that allows authenticated attackers to execute arbitrary SQL commands through vulnerable POST parameters (filter_type_id, filter_pid_id, and filter_search). While authentication is required, this significantly lowers the barrier to exploitation for insider threats or compromised user accounts. The vulnerability enables attackers to extract sensitive database information, user credentials, and server data, potentially leading to complete database compromise. Organizations running Joomla installations with this outdated component version face direct risk to data confidentiality and integrity.

Casky's 301 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with TA0001 (Initial Access/Reconnaissance) and TA0043 (Reconnaissance) techniques by analyzing SQL injection attack chains. When a practitioner runs Casky against network traffic or application logs, they would identify suspicious POST requests to the extroformfield view containing SQL metacharacters (single quotes, UNION statements, comment sequences) in the vulnerable parameters. The platform correlates these indicators with CWE-89 patterns to distinguish legitimate requests from exploitation attempts, alerting practitioners to parameter manipulation before data exfiltration occurs. By mapping to MITRE techniques, Casky helps security teams understand not just that an attack occurred, but how it fits into an attacker's larger reconnaissance or data gathering workflow.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25380.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2018-25380

Casky has 301 skills that investigate the attack patterns behind CVE-2018-25380. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn