Executive brief
Regular Labs DB Replacer, a tool used to manage and update Joomla database content, contains a security flaw in how it handles administrative requests. An unauthorized user with backend access, or an attacker who tricks an administrator into clicking a malicious link, could perform unauthorized database replacements. This could lead to significant data corruption, loss of website integrity, or a complete site compromise.
Technical details
The DB Replacer extension for Joomla (versions 1.0.0 through 8.2.7) suffers from improper access control (CWE-284) within its administrator routes and replacement request handlers. The component fails to consistently verify Super User privileges and lacks sufficient CSRF token validation for sensitive database operations. An attacker with low-privileged backend access, or a remote attacker leveraging a Cross-Site Request Forgery (CSRF) attack against a logged-in administrator, can execute arbitrary search-and-replace operations across the Joomla database. This can result in data corruption or full site takeover by modifying administrative credentials or injecting malicious content.
Affected products
- Regular Labs DB Replacer extension for Joomla 1.0.0 through 8.2.7
Timeline
- 2026-07-22: advisory: NVD publication date