CVE-2020-37218

Joomla com_hdwplayer 4.2 SQL Injection via search.php

Published May 13, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL payloads in the hdwplayersearch parameter to extract sensitive database information from the hdwplayer_videos table.

Analysis

Technical impact

This vulnerability is an SQL injection flaw in the search.php file of Joomla com_hdwplayer 4.2, triggered by the hdwplayersearch POST parameter. An attacker can supply arbitrary SQL code that is executed against the database, allowing extraction of sensitive data from the hdwplayer_videos table. No capability to modify or delete data is documented in the description.

Affected Systems

The affected component is Hdwplayer's com_hdwplayer 4.2 within a Joomla installation. Only this specific release is listed as vulnerable; no other versions are noted.

Risk and Exploitability

The CVSS score of 8.8 places the flaw in the high severity range, reflecting significant potential data loss. The EPSS score is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. Because the flaw is triggered by unauthenticated POST requests to search.php, the attack surface is publicly accessible. An attacker can manually construct a payload or use automated tools to extract database information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Hdwplayer

com_hdwplayer

affected

Version	Status	Constraints
`4.2`	affected	—

No data.

Vendor Product Versions

Hdwplayer

Hdw Player

Version	Status	Scheme	Platform
`4.2`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any official patch or update released by the vendor that removes the vulnerable code; if no update exists, consider uninstalling the component until a fix is available.
Restrict access to the search.php endpoint by limiting allowed IP ranges or implementing web‑application firewall rules to block suspicious POST traffic.
Implement proper input validation for the hdwplayersearch parameter, ensuring only expected characters are allowed and that database queries use parameterized statements or appropriate escaping before execution.

Generated by OpenCVE AI on May 13, 2026 at 17:08 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.270% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.exploit-db.com/exploits/48242
https://www.hdwplayer.com/
https://www.hdwplayer.com/download/
https://www.vulncheck.com/advisories/joomla-com-hdwplayer-sql-injection-via-search-php

History

May 14, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 13, 2026 3:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL payloads in the hdwplayersearch parameter to extract sensitive database information from the hdwplayer_videos table.
Title		Joomla com_hdwplayer 4.2 SQL Injection via search.php
First Time appeared		Hdwplayer Hdwplayer hdw Player
Weaknesses		CWE-89
CPEs		cpe:2.3:a:hdwplayer:hdw_player:4.2:::::::*
Vendors & Products		Hdwplayer Hdwplayer hdw Player
References		https://www.exploit-db.com/exploits/48242 https://www.hdwplayer.com/ https://www.hdwplayer.com/download/ https://www.vulncheck.com/advisories/joomla-com-hdwplayer-sql-injection-via-search-php
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`