CVE-2018-17254: Joomla JCK Editor SQL injection in links.php parent parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction access and public exploit code makes this an urgent patch-or-mitigate item.

What it is

The JCK Editor component 6.4.4 for Joomla! is vulnerable to SQL injection through the parent parameter in jtreelink/dialogs/links.php. The flaw is remotely reachable without authentication and carries a critical CVSS score of 9.8, so any exposed installation is at serious risk.

Impact

An attacker can inject arbitrary SQL into the application's database queries, potentially reading, modifying, or deleting data and, depending on database privileges, escalating to broader compromise of the Joomla site.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), meaning the vulnerable links.php endpoint can be hit directly over HTTP by an unauthenticated attacker.

Exploitation

Public exploit code is referenced in Exploit-DB and Packet Storm, and EPSS is 0.82976 (99.657th percentile), indicating a high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Update JCK Editor to a version later than 6.4.4, or remove the component if it is no longer maintained.
• If patching is not immediately possible, block or restrict access to jtreelink/dialogs/links.php at the web server or WAF.
• Apply least-privilege database credentials for the Joomla database user to limit SQL injection impact.
• Audit the Joomla site for the JCK Editor component and remove unused extensions.
• Monitor Joomla and vendor advisories for a fixed release.

Detection

• Inspect web server and WAF logs for requests to jtreelink/dialogs/links.php with suspicious parent parameter values.
• Search for SQL injection patterns such as UNION, SLEEP, or quote characters in the parent parameter.
• Alert on unexpected database errors or anomalous query behavior originating from the Joomla application.
• Review database activity for unauthorized reads or writes from the Joomla database user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.