Vulnerability record · CVE-2014-7228 · published 3 November 2014
CVE-2014-7228: Akeeba Restore parameter cleansing flaw enables remote code execution
Joomla · Joomla\!
Akeeba Restore (restore.php) fails to remove parameters from $_GET and $_POST while cleansing $_REQUEST, then later reads those arrays through getQueryParam. This lets a remote attacker bypass encryption and execute arbitrary code by sending a command message that extracts a crafted archive. The flaw affects multiple Akeeba products bundled with Joomla, WordPress and standalone tools.
Description
Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with a public exploit and very high EPSS score, though no confirmed KEV or ransomware use.
What it is
Akeeba Restore (restore.php) fails to remove parameters from $_GET and $_POST while cleansing $_REQUEST, then later reads those arrays through getQueryParam. This lets a remote attacker bypass encryption and execute arbitrary code by sending a command message that extracts a crafted archive. The flaw affects multiple Akeeba products bundled with Joomla, WordPress and standalone tools.
Impact
An unauthenticated remote attacker can bypass the encryption protecting backup/restore command messages and execute arbitrary code on the server. This typically yields full control of the affected web application and its host.
Attack surface
Reachable over the network through restore.php during a backup or update operation, with no authentication required per the CVSS vector (AV:N/AC:L/Au:N). No user interaction is indicated by the description or vector.
Exploitation
Not listed in CISA KEV, but a public exploit write-up is referenced and EPSS is 0.554 (99th percentile), indicating high likelihood of exploitation activity.
What to do
- Apply the vendor security updates for Akeeba Backup, Admin Tools, CMS Update and the Joomla core release that bundles the fixed restore.php.
- Remove or restrict access to restore.php and kickstart scripts on production systems when not actively performing a restore.
- Block or monitor direct HTTP requests to restore.php and related Akeeba scripts at the web server or WAF.
- Upgrade Joomla to a release outside the affected 2.5.4-2.5.25, 3.x-3.2.5 and 3.3.0-3.3.4 ranges.
- Audit for unexpected archive files or newly written PHP files in web-accessible directories.
Detection
- Search web logs for POST or GET requests to restore.php containing command or archive-extraction parameters.
- Monitor for new or modified PHP files in web roots following restore.php activity.
- Alert on outbound connections or process execution spawned by the web server user after restore.php requests.
- Review file integrity monitoring alerts for changes to restore.php or Akeeba component files.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-7228 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-7228), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
