CVE-2026-102788: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension Gridboxto a version that resolves this vulnerability.Fixed in 2.20.4.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Gridbox versions earlier than 2.20.4.2 are affected where store product list pages are reachable. The vulnerable input is the sort-by URL parameter on those pages.
Does an attacker need to authenticate to exploit it?
No. The issue is described as unauthenticated, so an attacker can target an exposed store product list page without logging in.
What input is used for the SQL injection?
The sort-by URL parameter is used. Values that do not match recognized sorting keys can be incorporated into the SQL ORDER BY clause without an allowlist check.
How can I determine whether a site may be affected?
Check whether the site uses Balbooa Gridbox and whether its version is earlier than 2.20.4.2. Also identify whether Gridbox store product list pages accept a sort-by parameter in their URLs.