CVE-2025-25226

The vulnerability lies in the protected quoteNameStr method of the base class of the Joomla Framework database package. In the original 2.x and 3.x branches, this method is not directly called, so the framework itself in standard configuration is not vulnerable. However, the problem may occur in classes inheriting from the affected base class if an extension or external code uses the vulnerable method — in which case an attacker can inject malicious SQL queries.

In a scenario where the vulnerable method is used by derived classes, an attacker can gain unauthorized access to database data, modify or delete data, and potentially take control of the application (full CIA triad: confidentiality, integrity, availability).

Apply patches available from the vendor according to the references provided. Additionally, it is recommended to review your own extensions and classes inheriting from the Joomla Framework database package for use of the quoteNameStr method, and if used, urgently update or refactor the code.

Joomla Framework, database package in 2.x and 3.x branches — exclusively in cases of classes extending the affected base class and using the quoteNameStr method. Original classes provided by the vendor are not directly vulnerable.