Executive brief
JoomCCK, a content construction kit extension for the Joomla web platform, contains a security flaw in its front-end controller. This vulnerability allows an attacker to manipulate database queries by sending specially crafted web requests. If exploited, an attacker could potentially access, modify, or delete sensitive information stored in the website's database.
Technical details
A SQL injection vulnerability exists in the JoomCCK extension for Joomla (versions 1.0 through 6.4.0). The issue resides in a front-end controller task that constructs two SQL statements by directly concatenating user-supplied request parameters into the query string without proper escaping or parameterization (CWE-89). A remote, unauthenticated attacker can exploit this by sending malicious HTTP requests to the affected component. Successful exploitation allows for unauthorized database queries, which can lead to data exfiltration or administrative bypass.
Affected products
- JoomCoder JoomCCK extension for Joomla 1.0-6.4.0
Timeline
- 2026-06-28: disclosed: CVE published by the Joomla! Project