CVE-2026-78072 in Sexy Polling Reloaded Extension
Summary
by MITRE • 08/28/2026
Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified as an unauthenticated blind SQL injection flaw within the Joomla extension Sexy Polling Reloaded, specifically affecting versions prior to 5.6.1, represents a critical security risk for websites utilizing this component. This extension is designed to allow site administrators and users to create polls, but its implementation contains insufficient input validation mechanisms when processing user-supplied data. The core of the issue lies in how the application handles parameters passed through HTTP requests without adequate sanitization or type checking before incorporating them into database queries. Because the vulnerability exists at an unauthenticated level, any individual with access to the public-facing web interface can exploit this weakness without needing valid credentials, significantly lowering the barrier for entry and increasing the potential attack surface considerably.
From a technical perspective, blind SQL injection differs from traditional error-based or union-based injections in that it does not return data directly within the HTTP response body. Instead, an attacker must infer information about the database structure by observing subtle changes in application behavior, such as differences in page load times or specific boolean responses to true and false conditions. In the context of Sexy Polling Reloaded, this likely involves manipulating parameters related to poll IDs, user votes, or configuration settings that are directly concatenated into SQL statements without proper escaping. The attacker can construct a series of crafted requests containing logical operators like AND 1=1 or AND 1=2 to determine if the underlying database engine processes the input correctly and reveals structural details about the backend system. This method allows for the extraction of sensitive data, including administrator usernames, hashed passwords, session tokens, and other critical configuration information stored in the Joomla database.
The operational impact of this vulnerability is severe due to its unauthenticated nature. An attacker can systematically enumerate the entire database schema, extract user credentials which may be reused across multiple platforms if password hygiene practices are poor, or potentially escalate privileges by manipulating administrative accounts found within the database. In some scenarios, depending on the specific configuration and capabilities enabled in the MySQL server instance, such as FILE privilege access, an attacker might even write malicious files to the web root, leading to full remote code execution. This compromises not only the integrity of the poll data but also the confidentiality and availability of the entire Joomla installation, potentially serving as a foothold for further lateral movement within the network infrastructure hosting the application.
This vulnerability aligns with CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific exploitation technique falls under MITRE ATT&CK tactic T1059, specifically subtechnique 004 for Command and Scripting Interpretation if code execution is achieved via database functions, or more accurately T1190 Exploit Public-Facing Application when considering the initial access vector through a web application. The lack of authentication required to trigger this flaw highlights a failure in implementing proper input validation controls at the entry points of the application logic.
To mitigate this risk, site administrators must immediately update the Sexy Polling Reloaded extension to version 5.6.1 or later where these issues have been addressed by the developers through improved parameterized queries and stricter input filtering. Until an upgrade is possible, implementing a Web Application Firewall can provide a layer of defense by detecting and blocking common SQL injection patterns in HTTP requests. Additionally, reviewing database user permissions to adhere to the principle of least privilege ensures that even if exploitation occurs, the potential damage is contained within limited operational boundaries rather than granting full administrative control over the database server. Regular security audits and penetration testing should be conducted on all third-party Joomla extensions to identify similar vulnerabilities before they can be exploited in production environments.