CVE-2020-37218: SQL Injection in Joomla com_hdwplayer

The primary impact of CVE-2020-37218 is unauthorized data extraction. An attacker can craft malicious POST requests containing SQL payloads within the hdwplayersearch parameter to bypass security controls and directly query the database. This allows them to retrieve sensitive information stored in the hdwplayervideos table, such as video titles, descriptions, and potentially user-related data if stored within that table. While direct remote code execution is unlikely, the attacker could potentially use the extracted data to gain further insights into the system or launch subsequent attacks. The blast radius extends to any data stored within the hdwplayervideos table accessible through the SQL injection.

1. Publicada2026-05-13

The recommended mitigation for CVE-2020-37218 is to immediately update the com_hdwplayer component to a patched version. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the hdwplayersearch parameter to prevent SQL injection attempts. Web Application Firewalls (WAFs) configured with rules to detect and block SQL injection patterns targeting the hdwplayersearch parameter can provide an additional layer of defense. Monitor Joomla logs for suspicious SQL queries originating from external sources. After upgrading, confirm the vulnerability is resolved by attempting a test SQL injection payload via the hdwplayersearch parameter and verifying that it is properly sanitized.