Executive brief
SP Page Builder is a drag-and-drop page composer plugin for the Joomla content management system. An authenticated attacker can inject SQL commands through a form field in the Content plugin, allowing them to read sensitive database tables including user credentials and active sessions, potentially leading to account compromise or unauthorized access to the website.
Technical details
The vulnerability is an authenticated SQL injection in the plgContentSppagebuilder::onContentAfterSave() method. The plugin reads the jform[attribs][sppagebuilder_article_id] parameter from the request and concatenates it directly into a WHERE clause without quoting or type casting. Because Joomla's ARRAY input filter does not sanitize individual array element values, an attacker can deliver a complete SQL injection payload in a single POST field. The vulnerable code executes on every onContentAfterSave event before component-level access checks, allowing exploitation regardless of context. An attacker can perform time-based blind SQL injection to extract arbitrary database contents from tables such as #__users and #__session.
Affected products
- JoomShaper SP Page Builder 5.2.1 to 6.9.0
Timeline
- 2026-09-14: disclosed: CVE-2026-78375 published