Executive brief
Sulu is a content management system used to publish and manage website content. A flaw in its Smart Content category filter allows any anonymous visitor to inject malicious SQL-like queries through a public web parameter, potentially revealing unpublished pages and other sensitive content, or causing the site to become slow or unresponsive.
Technical details
A JCR-SQL2 injection vulnerability exists in the Smart Content category filter of Sulu 2.x, where category IDs from the public `categories` query parameter are trimmed but concatenated directly into a JCR-SQL2 WHERE clause without numeric validation. Unlike the existing tag filter, category IDs are not cast to integers before use in the query. An unauthenticated attacker can exploit this via any public page rendering a Smart Content element with category filtering enabled, allowing blind boolean-based content enumeration (disclosure of unpublished nodes) and denial-of-service through malformed queries. The impact is limited to reading and enumerating content-repository nodes; data modification is not possible through this path. The vulnerability has been patched in versions 2.6.25 and 3.0.8 by casting all ID parameters to integers.
Affected products
- Sulu Sulu 2.x before 2.6.25, 3.x before 3.0.8
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 2.6.25 and 3.0.8