CVE-2026-77994 in Page Builder CK Extension
Summary
by MITRE • 08/24/2026
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified as CVE-2024-XXXXX affects the Page Builder CK component for Joomla, specifically in versions prior to 3.6.5 developed by joomlack.fr. This extension is widely used for creating dynamic content and layouts within the Joomla CMS ecosystem. The core of this security flaw lies in the loadStyles method located within the frontend page model class. During normal operation, this method processes style configurations associated with pages built using the component. However, it fails to adequately sanitize or validate user-supplied input before incorporating it into SQL queries executed against the backend database. This lack of proper data validation creates a pathway for attackers to inject malicious Structured Query Language code, leading to a second-order SQL injection vulnerability.
Second-order SQL injection differs from first-order injections in that the malicious payload is not immediately executed upon submission but is instead stored within the application's persistent storage, such as a database record or configuration file. The attack becomes effective only when the application later retrieves this stored data and processes it without proper sanitization. In the context of Page Builder CK, an attacker can initially submit crafted input through legitimate administrative interfaces or frontend forms that are accepted by the system due to insufficient immediate validation checks. This malicious payload is then saved into the database associated with a specific page's style configuration. When an administrator or another user subsequently views or edits the affected page, the loadStyles method retrieves this stored data and passes it directly into a SQL query without re-sanitizing it. The database engine interprets the injected code as part of the command structure rather than as literal data, allowing for arbitrary execution of SQL statements.
The operational impact of this vulnerability is severe due to its potential for unauthorized access and data manipulation. Because second-order injections often occur in contexts where input validation might be relaxed or overlooked by developers assuming prior sanitization has occurred, they are particularly insidious. An attacker with low-level privileges could exploit this flaw to escalate their rights within the Joomla application environment. By manipulating SQL queries, an adversary can extract sensitive information from other tables in the database, such as user credentials, session tokens, or proprietary content data. Furthermore, depending on the configuration of the underlying Database Management System and the permissions granted to the web server's database account, it may be possible to modify existing records, delete critical application data, or even execute operating system commands if specific extensions like xp_cmdshell are enabled in Microsoft SQL Server environments. This compromises the confidentiality, integrity, and availability of the entire Joomla site hosted on the affected server.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. The specific nature of storing malicious input for later execution places it firmly within the second-order variant category. In terms of adversary tactics and techniques, this exploitation path corresponds to ATT&CK technique T1059 Command and Scripting Interpreter if command execution is achieved through database extensions, or more broadly to T1190 Exploit Public-Facing Application when targeting web-facing instances. The vulnerability highlights a critical gap in the secure coding practices of the extension developer regarding input validation at all points of use rather than just at initial entry points.
Mitigation strategies for this issue primarily involve upgrading the Page Builder CK component to version 3.6.5 or later, where the loadStyles method has been patched with proper parameterized queries or rigorous output encoding mechanisms. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations should focus on restricting database user privileges to the principle of least privilege, ensuring that the web application's database account does not have administrative rights such as FILE or EXECUTE permissions. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests, although this is less effective against second-order injections since the malicious payload may appear benign during initial submission. Regular security audits and code reviews focusing on data flow analysis are essential to identify similar latent vulnerabilities where stored input is reused without adequate sanitization.