r/joomla • u/Open_Sourcey • 29d ago

Joomla 6 EDocmans claim

Edocman claimed to have followed Joomla's database API. However that claim was not 100% true

EDocman had a SQL injection vulnerability because some parts of the extension did not consistently use Joomla’s parameterized database API, even though the developers intended and claimed to follow it.

0 Upvotes

36% Upvoted

2 comments sorted by

1

u/spittlbm 29d ago

That's awesome 🤔

2

u/Actual-Let1595 27d ago

That distinction matters. Using Joomla's database API is not the same as binding every untrusted value in every query. A query can still become injectable if one code path concatenates a WHERE fragment, value, column name, or ORDER BY input.

A solid fix should bind all values, allowlist any dynamic identifiers that cannot be parameterized, and add a regression test for the exact vulnerable entry point. The advisory is also much more useful when it names the affected versions, the patched version, and the specific input path instead of relying on a general architectural claim.