Executive brief
Pulse Extensions Sponsor Wall, a Joomla component used to display and manage website sponsors, contains a security flaw that allows unauthorized individuals to access the underlying database. By sending a specially crafted web request, an attacker can bypass security controls to steal sensitive information, such as user credentials and site configuration data. This could lead to a full compromise of the website's administrative functions and the exposure of private data.
Technical details
An SQL injection vulnerability exists in the 'wallid' parameter of the Sponsor Wall component (version 8.0) for Joomla. The flaw is located within the 'click' task of the 'com_sponsorwall' component. An unauthenticated remote attacker can exploit this by sending a crafted GET request to index.php, injecting malicious SQL commands into the wallid parameter. This occurs due to improper neutralization of special elements used in an SQL command (CWE-89). Successful exploitation allows the attacker to perform unauthorized data extraction, including database schema details, administrative credentials, and configuration settings. While the advisory mentions version 8.0, later versions like 15.0 are available, though specific patch details for this 2017-era flaw are not explicitly detailed in the provided text.
Affected products
- Pulse Extensions Sponsor Wall 8.0
Timeline
- 2017-08-21: disclosed: Initial exploit code published on Exploit-DB
- 2026-06-19: advisory: CVE published and NVD record created