Executive brief
JoomShaper SP Page Builder, a popular drag-and-drop design tool for Joomla websites, contains a critical security flaw in its Dynamic Content feature. An unauthorized attacker can exploit this vulnerability to read sensitive information from the website's database, including user account details and password hashes. This could lead to a full site takeover or the theft of customer data without leaving obvious signs of a breach.
Technical details
An unauthenticated SQL injection vulnerability exists in SP Page Builder versions prior to 6.7.1. The 'Dynamic Content' endpoint fails to properly validate or sanitize the sort direction parameter (ORDER BY) before using it in a database query. While the endpoint is protected by a CSRF token, Joomla provides these tokens to anonymous visitors, making the flaw effectively reachable without authentication. An attacker can use time-based or error-based techniques to extract sensitive data from the Joomla database, including the site secret and user credentials. The fix in version 6.7.1 restricts the sort direction to 'ASC' or 'DESC' and implements stricter permission checks on the endpoint.
Affected products
- JoomShaper SP Page Builder extension for Joomla 1.0.0 - 6.7.0
Timeline
- 2026-07-27: patched: Fixed in version 6.7.1
- 2026-07-27: disclosed: Discovered and reported by mySites.guru
- 2026-07-27: advisory