A credential leakage vulnerability in the Regular Labs GeoIP extension for Joomla allows unauthorized access to MaxMind services via exposed request parameters.

This is a sensitive information exposure vulnerability where MaxMind credentials are transmitted in request URLs. This data can be captured by logs, proxies, or browser history, allowing attackers to hijack the service account.

With a CVSS score of 7.5, this vulnerability enables unauthorized consumption of paid GeoIP services. This can result in significant financial loss through quota exhaustion and potential exposure of sensitive geolocation data associated with the victim's account.

Immediate Action: Update to the latest version of the Regular Labs GeoIP extension for Joomla, such as 7.0.3 or later.

Proactive Monitoring: Audit web server logs and proxy logs for the presence of sensitive credential information in request URLs.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests that contain patterns matching leaked credential formats.

Public Exploit Available: No (unknown)

Users of the GeoIP extension must update to the latest patched version immediately. Following the update, consider rotating any MaxMind credentials that may have been exposed in logs or history.