CVE-2026-65877 in SP Page Builder Extension
Summary
by MITRE • 07/27/2026
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability affects the Joomla extension developed by joomshaper.com known as SP Page Builder version 6.7.1 and earlier, representing a critical authenticated SQL injection flaw that compromises the integrity of the underlying database system. The security weakness stems from inadequate input validation within the media manager search functionality and date filter mechanisms, allowing authenticated attackers with sufficient privileges to manipulate database queries through maliciously crafted parameters. The vulnerability specifically manifests when users interact with the media management interface, particularly during search operations or when applying date-based filters to content collections.
The technical flaw resides in the improper sanitization of user-supplied input parameters that are directly incorporated into SQL query construction without adequate escaping or parameterization. When authenticated users submit search terms or select date ranges within the SP Page Builder admin panel, the application fails to properly validate or escape these inputs before integrating them into database queries. This design oversight creates an exploitable condition where malicious payloads can be injected into the SQL execution context, potentially enabling attackers to extract sensitive data, modify database records, or execute unauthorized administrative commands.
The operational impact of this authenticated SQL injection vulnerability extends beyond simple data theft, as it provides attackers with significant privileges within the Joomla ecosystem. An attacker with valid user credentials can leverage this weakness to escalate their access level, potentially gaining administrator privileges or bypassing authentication mechanisms entirely. The vulnerability affects database integrity and confidentiality, as malicious actors could retrieve user credentials, content management information, or other sensitive organizational data stored in the database. Additionally, the attack surface includes potential privilege escalation opportunities that could allow attackers to modify core system configurations or deploy malicious payloads within the Joomla installation.
Mitigation strategies should prioritize immediate patching of the SP Page Builder extension to version 6.7.1 or later, which contains the necessary security fixes for parameter validation and input sanitization. Organizations should implement robust database access controls, ensuring that database accounts used by Joomla have minimal required privileges and that proper input validation is enforced at multiple layers of application architecture. Network segmentation and monitoring solutions should be deployed to detect anomalous database query patterns indicative of SQL injection attempts. The vulnerability aligns with CWE-89 which specifically addresses SQL injection flaws in software applications, and corresponds to ATT&CK technique T1071.004 for Application Layer Protocol: DNS, as attackers may use this vulnerability to establish persistent access or exfiltrate data through database interactions. Security teams should also conduct comprehensive code reviews focusing on input validation practices and implement automated testing procedures to identify similar vulnerabilities in other components of the Joomla platform or custom extensions.