Attack Chain

1. An attacker gains valid credentials for the Joomla J2 JOBS 1.3.0 component.
2. The attacker crafts a malicious POST request to the administrator index.
3. The POST request includes the ‘sortby’ parameter with SQL injection payloads.
4. The application fails to properly sanitize the ‘sortby’ parameter.
5. The unsanitized ‘sortby’ value is incorporated into an SQL query.
6. The injected SQL code is executed by the database server.
7. The attacker extracts sensitive information from the database.
8. The attacker may use the extracted information for further attacks or data exfiltration.

Impact

Successful exploitation of this vulnerability (CVE-2020-37224) allows an authenticated attacker to inject arbitrary SQL queries, potentially leading to sensitive information disclosure. Depending on the database privileges, attackers might be able to modify data, escalate privileges, or even execute arbitrary code on the server. The impact could range from data breaches and service disruption to complete system compromise.

Recommendation

• Apply available patches or updates for Joomla J2 JOBS to address CVE-2020-37224.
• Deploy the Sigma rule provided below to detect potential exploitation attempts targeting the ‘sortby’ parameter.
• Review web server access logs for suspicious POST requests to the administrator index containing SQL syntax within the ‘sortby’ parameter.
• Implement input validation and sanitization for all user-supplied input, particularly the ‘sortby’ parameter, to prevent SQL injection attacks.