CVE-2025-32466 Extension - rsjoomla.com - SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla
Attackers can inject SQL commands via unsanitized input in the RSMediaGallery component, potentially accessing or modifying database content.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-32466?
CVE-2025-32466 is a medium-severity SQL injection vulnerability in rsjoomla.com RSMediaGallery component for Joomla, published on 11 Jun 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
Weakness: CWE-89
Which versions are affected by CVE-2025-32466?
How do I fix CVE-2025-32466?
No fix has been published for CVE-2025-32466 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-32466 being exploited?
There is no known exploitation of CVE-2025-32466 in the wild and no public exploit code.
Sources
Also known as GHSA-rp7w-qpv5-65rh.