Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Gridbox extension for Joomla, a website builder component from balbooa.com, is affected by an unauthenticated SQL injection flaw. An attacker can manipulate the sort-by parameter on store product list pages to inject malicious database queries, potentially allowing unauthorized reading or modification of site data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Affected versions
- com_gridbox
1.0.0-2.20.4.1