CVE-2026-78375
Received Received - Intake

Authenticated SQL Injection in SP Page Builder Joomla Plugin

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and concatenated it directly into the WHERE view_id = ... clause of a query against #__sppagebuilder without quoting or type casting. Joomla's ARRAY input filter does not sanitise element values, as InputFilter::clean() returns (array) $source with the elements untouched, so the entire payload could be delivered in a single POST field. The affected block also executed before the com_content.article context test, so it ran on every onContentAfterSave event regardless of which component triggered the save. An attacker could perform time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-78375
EUVD
EUVD-2026-77380

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
joomla sp_page_builder 5.2.1
joomla sp_page_builder 6.9.0
joomshaper sp_page_builder 5.2.1
joomshaper sp_page_builder 6.9.0
joomshaper sp_page_builder From 3.10 (inc) to 4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated SQL injection vulnerability in the SP Page Builder Joomla extension versions 5.2.1 to 6.9.0. The flaw exists in the Content Plugin where user-controlled input from a POST field is directly concatenated into a SQL query without proper sanitization or type casting. This allows attackers with valid credentials to execute time-based blind SQL injection, potentially reading sensitive database contents like user credentials or session data.

Detection Guidance

To detect this vulnerability, monitor Joomla logs for unusual SQL query patterns or time delays in responses from the SP Page Builder plugin. Check for POST requests to index.php with parameters containing jform[attribs][sppagebuilder_article_id] that include SQL syntax like quotes or comments. Use tools like grep to search logs for 'plgContentSppagebuilder' or 'onContentAfterSave' events.

Impact Analysis

If you use SP Page Builder versions 5.2.1 to 6.9.0 on your Joomla site, an attacker with valid credentials could exploit this to extract sensitive data from your database, including user accounts and session information. This could lead to unauthorized access, data breaches, or further compromise of your Joomla installation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and potentially triggering breach notification requirements. For HIPAA-covered entities, it may compromise protected health information, leading to compliance violations and penalties. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Immediately update SP Page Builder to version 6.9.1 or later. Disable the Content Plugin of SP Page Builder if not in use. Review and restrict database access permissions for Joomla users. Monitor database queries for suspicious activity and apply Joomla's latest security patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart