EDocman (com_edocman) below 3.9 - Unauthenticated SQL Injection (full database read)
A public front-end endpoint in EDocman (the document and download manager for Joomla by JoomDonation) placed a request parameter into a database query without sanitising it, an unauthenticated SQL injection (CWE-89). An anonymous visitor, with no login, no CSRF token and no user interaction, could read data from any table in the site database in a single request: user accounts, bcrypt password hashes, password reset tokens and the Joomla secret. Both error-based (fast) and time-based blind extraction work. Where the site connects to MySQL with a privileged account, the read reaches every database on that server, not just this site. mySites.guru discovered and reported this privately; JoomDonation fixed it in EDocman 3.9 (released 14 July 2026). Affects 3.8 and earlier. Update to 3.9 or later immediately. Interim mitigation: a web application firewall with SQL injection filtering enabled can block many attempts, but it is mitigation, not a fix. CVSS 4.0 8.7 (High), our own assessment; CVE pending via the Joomla CNA.
Affected versions: < 3.9
Full advisory: our disclosure post
