CVE-2014-7228 Code injection in n/a
Remote attackers can execute arbitrary code by bypassing encryption in Akeeba Restore plugins via crafted archive parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-7228?
CVE-2014-7228 is a high-severity code injection vulnerability in Joomla Joomla\!, published on 3 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
Weakness: CWE-310
Which versions are affected by CVE-2014-7228?
It affects 1 product.
Products include Joomla Joomla\!.
How do I fix CVE-2014-7228?
No fix has been published for CVE-2014-7228 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2014-7228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-7228 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Joomla Joomla\!
- CVE-2016-10033 PHPMailer Command Injection
- CVE-2023-23752 Joomla! Improper Access Control
- CVE-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
- CVE-2025-25226 [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package
- CVE-2022-23795 [20220303] - Core - User row are not bound to a authentication mechanism
Sources
Also known as GHSA-99g7-532h-x95c.