CVE-2019-25762 in JoomProject
Summary
by MITRE • 06/19/2026
Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/23/2026
The Joomla! Component JoomProject version 1.1.3.2 contains a critical information disclosure vulnerability that exposes sensitive user data to unauthenticated attackers. This vulnerability resides within the component's projects endpoint implementation, where improper access controls allow any remote user to retrieve confidential information without requiring authentication credentials. The flaw specifically manifests when attackers submit requests to the index.php script with the parameters option=com_jpprojects&view=projects&tmpl=component&format=json which triggers the component to return user data in structured json format.
The technical nature of this vulnerability aligns with CWE-200, which defines information exposure as a weakness where system information is disclosed to unauthorized actors. The flaw represents a classic case of insufficient access control where the component fails to validate whether the requesting entity has proper authorization to access the requested user data. When the vulnerable endpoint processes these specific parameters, it bypasses normal authentication mechanisms and directly exposes user identifiers including unique user IDs, personal names, and email addresses in a machine-readable json format that can be easily consumed by automated tools.
The operational impact of this vulnerability extends beyond simple data exposure as it creates potential for further attacks within the compromised system. Attackers can leverage the leaked information to conduct targeted phishing campaigns, perform credential stuffing attacks against users whose email addresses are exposed, or use the collected user IDs for social engineering attempts. The JSON format response makes the data particularly valuable to attackers as it provides structured information that can be easily parsed and integrated into automated attack frameworks. This vulnerability affects any Joomla! installation running the affected component version regardless of the underlying server configuration or security measures in place.
Mitigation strategies should focus on immediate patching of the vulnerable component to version 1.1.3.3 or later where the access control mechanisms have been properly implemented. System administrators should also consider implementing additional network-level controls such as web application firewalls that can detect and block requests containing the specific vulnerable parameter combinations. The principle of least privilege should be enforced by ensuring that only authorized users with proper authentication credentials can access sensitive data endpoints. Organizations should conduct comprehensive security audits to identify other potentially vulnerable components within their Joomla! installations and implement proper input validation and output encoding mechanisms to prevent similar information disclosure scenarios. This vulnerability demonstrates the importance of proper access control implementation and aligns with ATT&CK technique T1213 which covers data from information repositories, emphasizing the need for robust access controls around user data exposure points within web applications.