Over 100 Bugs in a Row: Security Analysis of the Top-Rated Joomla Extensions
Marcus Niemietz, Mario Korth, Christian Mainka, Juraj Somorovsky

TL;DR
This paper analyzes the security vulnerabilities of popular Joomla extensions, revealing widespread XSS and SQLi issues, and discusses mitigation strategies to improve extension security to match that of the core CMS.
Contribution
It provides a comprehensive security analysis of top-rated Joomla extensions, highlighting prevalent vulnerabilities and proposing mitigation strategies to enhance extension security.
Findings
Nearly 50% of Joomla sites use top-10 extensions.
All analyzed top-10 extensions are vulnerable to XSS.
30% of these extensions are vulnerable to SQLi.
Abstract
Nearly every second website is using a Content Management System (CMS) such as WordPress, Drupal, and Joomla. These systems help to create and modify digital data, typically within a collaborative environment. One common feature is to enrich their functionality by using extensions. Popular extensions allow developers to easily include payment gateways, backup tools, and social media components. Due to the extended functionality, it is not surprising that such an expansion of complexity implies a bigger attack surface. In contrast to CMS core systems, extensions are usually not considered during public security audits. However, a Cross-Site Scripting (XSS) or SQL injection (SQLi) attack within an activated extension has the same effect on the security of a CMS as the same issue within the core itself. Therefore, vulnerabilities within extensions are a very attractive tool for malicious…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsWeb Application Security Vulnerabilities · Software Engineering Research · Security and Verification in Computing
