CVE-2026-102788
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Unauthenticated SQL injection vulnerability in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. On store product list pages, the sort-by URL parameter value is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(); when it does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without allowlist validation.
Risk Assessment
An unauthenticated attacker may execute arbitrary SQL queries, risking data leakage, modification, or deletion from the database. This poses a serious threat to the confidentiality and integrity of the store.
Recommendation
Update the Gridbox extension to version 2.20.4.2 or later. Consider deploying WAF rules filtering sorting parameters until the update is applied.
Other vulnerabilities in Gridbox
See all- CVE-2026-102789Critical
Missing authorization check in the editor controller task in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. The EditorController::getBlogPosts() method reads the order parameter and invokes getBlogPosts(), omitting the GridboxHelper::checkUserEditLevel() check used by other tasks in the controller.
- CVE-2026-65888Critical
The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.
- CVE-2026-65887Critical
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.
- CVE-2026-65890Critical
Joomla Extension Gridbox below version 2.20.2 has multiple SQL injection vectors allowing an unauthenticated attacker to inject SQL queries.
- CVE-2026-65884Critical
Joomla Extension Gridbox below version 2.20.2 has a privilege escalation vulnerability. The registration method allows users to provide usergroup IDs, enabling an unauthenticated attacker to register an account with administrative permissions.
- CVE-2026-61425Critical
The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.
- CVE-2026-102784High
The Joomla extension Gridbox (by balbooa.com) below version 2.20.4.0 contains a CSRF vulnerability in the language installation feature because the addLanguage action does not require POST and does not validate the session token.
- CVE-2026-102783Medium
Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.
- CVE-2026-65947High
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various CSRF vectors in the admin interface.
- CVE-2026-65886High
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to read arbitrary files via the photo viewer.
Original NVD description (English source)
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Vulnerability data from NVD (NIST) · CISA KEV · EPSS