CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.
Explanation of Vulnerability in Simple Terms
SP Page Builder for Joomla contains a SQL injection vulnerability in versions 1.0.0 through 6.7.0. An attacker with high-level administrator privileges can inject malicious SQL commands through the extension's input fields. This allows reading or modifying database contents, including user credentials and site configuration. Sites running affected versions should update immediately.
What an attacker can do
Read or modify the Joomla database, including user accounts and site configuration.
Potential impact on your site
A compromised admin account could expose all site data or allow further site takeover.
Conditions required to exploit
Attacker must have high-level administrator access to the Joomla site.
Key dates
External resources
Related vulnerabilities
