CVE-2025-2126
Published: 09 March 2025
Summary
CVE-2025-2126 is a medium-severity Injection (CWE-74) vulnerability in Joomlaux Jux Real Estate. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability classified as critical exists in JoomlaUX JUX Real Estate version 3.4.0 running on Joomla. It affects unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties within the GET Parameter Handler component. Manipulation of the title argument allows SQL injection, as indicated by the associated CWEs 74 and 89. The issue is remotely exploitable and carries a CVSS 4.0 score of 5.3.
An attacker with low privileges can initiate the attack over the network by supplying a crafted GET parameter. Successful exploitation enables the attacker to inject SQL commands, potentially leading to limited impacts on confidentiality, integrity, and availability within the affected component. The exploit has been publicly disclosed.
No vendor patch or mitigation guidance is available, as the vendor was contacted prior to disclosure but did not respond. The EPSS score remains low, with a current value of 0.0124 and a peak of 0.0138.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7511
Vulnerability details
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to…
more
sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Joomla web component endpoint directly enables remote exploitation of a public-facing application for initial access and limited data manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of the untrusted 'title' GET parameter before database processing.
Requires identification, reporting, and correction of the specific SQL injection flaw in the JUX Real Estate component, such as patching or implementing a workaround.
Enables detection of the SQL injection vulnerability through vulnerability scanning and subsequent remediation within defined timeframes.