{"id":"CVE-2026-102788","kind":"vulnerability","aliases":["CVE-2026-102788"],"related":[],"title":"Joomla Gridbox extension: unauthenticated SQL injection via store sort parameter","description":"Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist","summary":"Gridbox, a Joomla page-builder extension by balbooa.com, passes the sort-by URL parameter on store product list pages straight into an ORDER BY clause without an allowlist check. An unauthenticated remote attacker can inject SQL to read or change database contents.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","gridbox","joomla","package","php"],"not_affected_if":["gridbox-updated","no-store-pages"],"how_to_check":"- Check the installed Gridbox version in the Joomla extensions manager and confirm whether it is below `2.20.4.2`\n- Look for the Gridbox component on the site (`com_gridbox`) and whether store product list pages are published","fix":"- Update Gridbox to `2.20.4.2` or later from balbooa.com\n- Until updated, disable or unpublish the Gridbox store product list pages","status":"open","published_at":"2026-10-27T10:16:53+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:52+00:00","updated_at":"2026-10-27T10:31:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T10:31:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update Gridbox to `2.20.4.2` or later from balbooa.com\n- Until updated, disable or unpublish the Gridbox store product list pages","reach":"internet","title":"Joomla Gridbox extension: unauthenticated SQL injection via store sort parameter","impact":"high","summary":"Gridbox, a Joomla page-builder extension by balbooa.com, passes the sort-by URL parameter on store product list pages straight into an ORDER BY clause without an allowlist check. An unauthenticated remote attacker can inject SQL to read or change database contents.","category":"package","nicknames":[],"who_cares":["joomla","gridbox","php","e-commerce"],"confidence":0.8,"needs_auth":"no","worst_case":"database contents readable and modifiable by unauthenticated remote attackers","analyst_note":"Confirm the affected version range and whether a public exploit exists; check the NVD entry for the CVSS vector.","how_to_check":"- Check the installed Gridbox version in the Joomla extensions manager and confirm whether it is below `2.20.4.2`\n- Look for the Gridbox component on the site (`com_gridbox`) and whether store product list pages are published","needs_analyst":true,"not_affected_if":["gridbox-updated","no-store-pages"],"who_is_affected":"Sites running the Gridbox Joomla extension below `2.20.4.2` that expose store product list pages to the public. Sites without Gridbox, or with it updated, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000614,"input_tokens":3378,"output_tokens":553,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102788':13A,16A '-2026':12A,15A '2.20.4.2':76C 'alia':118C 'allowlist':53B,130C 'attack':58B 'balbooa.com':32B,70C 'builder':29B 'chang':65B 'check':54B,127C 'claus':50B,125C 'commerc':19B 'content':67B 'cve':11A,14A 'databas':66B 'direct':99C 'e':18B 'e-commerc':17B 'extens':3A,30B,69C 'filter':96C 'getblogpost':102C 'gridbox':2A,20B,24B,75C 'gridboxhelp':101C 'inject':6A,60B,73C 'insert':120C 'joomla':1A,21B,26B,68C 'key':111C 'known':109C 'list':43B,80C 'match':108C 'order':48B,123C 'packag':22B 'page':28B,44B,81C 'page-build':27B 'paramet':10A,39B,90C,105C 'pass':33B,98C 'php':23B 'prefix':114C 'product':42B,79C 'read':63B 'remot':57B 'retriev':92C 'sort':9A,36B,87C,110C 'sort-bi':35B,86C 'sql':5A,61B,72C 'store':8A,41B,78C 'straight':45B 'string':95C 'tabl':117C 'unauthent':4A,56B,71C 'url':38B,89C 'use':93C 'valu':83C 'via':7A 'without':51B,126C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gridbox Joomla extension below `2.20.4.2` that expose store product list pages to the public. Sites without Gridbox, or with it updated, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102788","severity":null,"published_at":"2026-10-27T10:16:53+00:00","modified_at":"2026-10-27T10:16:53+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}