CVE-2015-7297: Joomla! core SQL injection allows arbitrary SQL command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection in a widely deployed CMS with public exploit code and near-maximum EPSS, though not in KEV.

What it is

Joomla! 3.2 before 3.4.4 contains a SQL injection flaw in core code that lets remote attackers run arbitrary SQL commands through unspecified vectors. It is distinct from CVE-2015-7858. Because the injection is in core and reachable without authentication, it exposes the site database and, per public exploit write-ups, can lead to full administrative access.

Impact

An attacker can read and modify database contents, including user credentials and configuration, and public exploit material indicates this can be chained to full administrative access and remote code execution.

Attack surface

Reached over the network via HTTP against the Joomla! core; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The exact vulnerable parameter is not specified in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.99967, 99.976th percentile) and references include Exploit-DB, Packet Storm, Rapid7 Metasploit modules and a Trustwave blog tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade Joomla! to 3.4.4 or later immediately; this is the vendor fix.
• If immediate upgrade is not possible, restrict or block access to the affected core component at the web server or WAF until patched.
• Rotate Joomla! database credentials and administrator passwords after patching, since SQL injection may have exposed them.
• Review database and Joomla! admin accounts for unauthorized changes or additions.
• Apply least privilege to the Joomla! database user to limit what injected SQL can do.

Detection

• Inspect web server and WAF logs for SQL metacharacters (quotes, UNION, SLEEP, BENCHMARK) in requests to Joomla! endpoints.
• Monitor database logs for anomalous queries or errors originating from the web application user.
• Alert on unexpected creation of Joomla! administrator accounts or changes to user privilege tables.
• Hunt for outbound connections or file writes from the web server consistent with post-exploitation RCE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.