SP Page Builder 4 Vulnerabilities: Pre-Auth SQLi, Authenticated SQLi, Unauthorized Mail Relay, Arbitrary File Deletion

Vulnerability Overview Four security vulnerabilities exist in SP Page Builder version 6.7.0, specifically: 1. Pre-authentication SQL Injection (CVSS 4.0 8.7, High): The dynamic content endpoint places request values directly into the clause of database queries. This endpoint is protected only by a CSRF token, which Joomla provides to every anonymous visitor. Attackers can read the entire database, including password hashes. 2. Unauthenticated Mail Relay (CVSS 4.0 6.9, Medium): The recipient address in the contact form plugin is signed using a hardcoded shared secret. Attackers can forge emails and send them to any recipient, leading to spam and phishing attacks. 3. Authenticated SQL Injection (CVSS 4.0 7.1, High): The media manager's search and date filter parameters place request input directly into database queries. This vulnerability can be exploited by low-privilege users. 4. Authenticated Arbitrary File Deletion (CVSS 4.0 7.2, High): Media operations delete files based on the path provided in the request. Low-privilege users can delete critical files such as or . Affected Scope Affected Versions: SP Page Builder 6.7.0 and earlier. Affected Users: All Joomla website administrators using SP Page Builder 6.7.0 or earlier versions. Remediation Update Immediately: All users are advised to immediately update SP Page Builder to version 6.7.1. Backup Data: Before updating, it is recommended to back up the database and files. Update Method: 1. Update via Joomla's Extension Manager. 2. Use the batch update feature provided by mySites.guru. 3. After updating, confirm the version is 6.7.1 or higher. 4. Clear the cache. Proof of Concept (POC) No specific POC code or exploit code was provided. Additional Information Vulnerability Report: mySites.guru reported the vulnerabilities to JoomShaper on June 27, 2024. JoomShaper released the patched version 6.7.1 on July 27, 2024. CVE Numbers: CVE-2026-65766, CVE-2026-65877, CVE-2026-65878, CVE-2026-65879. Recommended Actions: Regularly check and update all Joomla extensions. Use mySites.guru services to monitor and manage vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

SP Page Builder 4 Vulnerabilities: Pre-Auth SQLi, Authenticated SQLi, Unauthorized Mail Relay, Arbitrary File Deletion