Teaching AI to hack Joomla so I can skip my homework
What began as a manual hunt for SQL injection CVEs in some random CRM software turned into a bigger question: could I semi-automate my workflow and have AI audit a huge CMS like Joomla without asking it to stare at every single database interaction in the codebase?
Pointing AI at any larger codebase and asking it to “find SQL injection pls” might result in lucky hits, but it is impractical: a large codebase contains far too many database interactions for that to be useful. I built a pipeline that maps those interactions and removes duplicates and boring or already-safe results. AI agents can then inspect the promising candidates individually, trace attacker-controlled input, check external reachability and transformations, and produce a working proof in a local environment. After manually reviewing the results, improving the proofs, and responsibly disclosing the findings, I ended up with two CVEs in the Joomla Core. The talk also dives into the more interesting com_finder bug, where a broken contract between two functions resulted in an exploitable second-order SQL injection. The whole adventure also had a practical excuse: getting a CVE assigned was how I could pass a university security lab :P
I am Adrian Junge (vurlo). I started programming in school, and back then I could not have imagined how deep that rabbit hole would go. My first deeper technical interest was algorithms, competitive programming, and the occasional LeetCode problem. Over time that problem-solving curiosity pulled me further into cybersecurity. Today I study computer science at Karlsruhe Institute of Technology (KIT) with a focus on cybersecurity, work in applied computer science at FZI Forschungszentrum für Informatik, and play CTFs with my university team KITCTF. Lately, I have been digging deeper into bug bounty work, coordinated disclosure, and CVE hunting.