Unauthenticated Stored XSS in SP Page Builder Joomla Extension

Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the SP Page Builder Joomla extension versions before 6.7.0. An attacker can inject malicious JavaScript into a Joomla site's database without authentication via a single HTTP request. When an administrator accesses the SP Page Builder editor, the stored script executes automatically in their browser.

Useful 0 Not Useful 0

Detection Guidance

Check if your Joomla site uses SP Page Builder version 6.7.0 or older. Inspect the Shapes API endpoint for unexpected JavaScript stored in the database. Review server logs for unusual POST requests to the SP Page Builder API.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions as an admin, deface the website, or deliver malware to visitors. Since it requires admin interaction to trigger, the primary risk is to site administrators who use the SP Page Builder editor.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. If exploited, it may result in data breaches requiring breach notifications under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update SP Page Builder to version 6.7.0 or later immediately. Remove any suspicious JavaScript stored in the database. Restrict access to the Shapes API endpoint if possible. Monitor administrator sessions for unusual activity.

Useful 0 Not Useful 0