Millions of websites used in e-commerce and other sensitive industries are vulnerable to remote take-over hacks made possible by a critical vulnerability that has affected the Joomla content management system for almost two years.

The SQL-injection vulnerability was patched by Joomla on Thursday with the release of version 3.4.5. The vulnerability, which allows attackers to execute malicious code on servers running Joomla, was first introduced in version 3.2 released in early November 2013. Joomla is used by an estimated 2.8 million websites.

"Because the vulnerability is found in a core module that doesn't require any extensions, all websites that use Joomla versions 3.2 and above are vulnerable," Asaf Orpani, a researcher inside Trustwave's Spiderlabs, wrote in a blog post. The vulnerability, and two closely related security flaws, have been cataloged as CVE-2015-7297, CVE-2015-7857, and CVE-2015-7858.

SQL-injection vulnerabilities allow end users to execute powerful commands on a website's backend database by entering specialized text in search boxes or other input fields found on a webpage. The flaws, which are among the most commonly exploited website vulnerabilities, are the result of an insecure Web application failing to enforce the treatment of incoming data as plaintext rather than executable code. Often, this makes it possible for hackers to download confidential files from the vulnerable server.

The bug discovered by Orpani exposes a session ID containing a browser cookie that's assigned to an administrator. Hackers can exploit the vulnerability to extract the cookie and then load it into their browser. At that point, they have the ability to access highly restricted parts of the server. Code exploiting the vulnerability has already been added to the Metasploit framework used by hackers and penetration testers.

"By pasting the session ID we've extracted—that of an administrator in this case—to the cookie section in the request to access the /administrator/ folder, we're granted administrator privileges and access to the administrator Control Panel," Orpani wrote.

Joomla administrators who haven't yet installed Thursday's patch should do so immediately.