CVE-2026-78375: Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilderarticleid] from the request and concatenated it directly into the WHERE viewid = ... clause of a query against #sppagebuilder without quoting or type casting. Joomla's ARRAY input filter does not sanitise element values, as InputFilter::clean() returns (array) $source with the elements untouched, so the entire payload could be delivered in a single POST field. The affected block also executed before the comcontent.article context test, so it ran on every onContentAfterSave event regardless of which component triggered the save. An attacker could perform time-based blind SQL injection to read arbitrary database contents, including the #users and #session tables.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
SP Page Builder Free and Pro versions 5.2.1 through 6.9.0 are affected when the SP Page Builder content plugin is present. The vulnerable handler runs for every onContentAfterSave event, not only saves made through the Joomla article component.
What access does an attacker need to exploit this issue?
An attacker needs authenticated privileged access that allows them to trigger an onContentAfterSave event and submit the jform[attribs][sppagebuilder_article_id] POST field. The injection payload can be supplied in that single field.
What could an attacker obtain through exploitation?
The issue supports time-based blind SQL injection, allowing an attacker to read arbitrary database contents. This can include Joomla user and session data from the #__users and #__session tables.