Executive brief
YouTube Gallery is a Joomla extension that allows site administrators to embed and display video galleries on their websites. An unauthenticated SQL injection vulnerability in the video search and sorting functionality allows attackers to read sensitive data from the database without requiring any credentials or user interaction. This could expose database contents including user information or other sensitive website data.
Technical details
An SQL injection vulnerability exists in the video search functionality and sorting parameters of YouTube Gallery, allowing unauthenticated attackers to inject arbitrary SQL commands in read queries. The vulnerability is accessible without authentication and does not require user interaction. Exploitation allows attackers to extract data from the underlying database; versions prior to 5.7.3 are affected.
Affected products
- JoomlaBoat YouTube Gallery < 5.7.3
Timeline
- 2026-09-26: disclosed