CVE-2026-78072 Overview
CVE-2026-78072 is an unauthenticated blind SQL injection vulnerability affecting the Sexy Polling Reloaded extension for Joomla, developed by Jefferson49. The flaw exists in versions prior to 5.6.1 and allows remote attackers to inject SQL statements without authentication. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Remote unauthenticated attackers can extract sensitive database contents from Joomla sites running vulnerable versions of Sexy Polling Reloaded, exposing user data, credentials, and site configuration.
Affected Products
- Joomla Extension: Sexy Polling Reloaded by Jefferson49
- Versions prior to 5.6.1
- Joomla CMS deployments with the vulnerable extension installed
Discovery Timeline
- 2026-08-28 - CVE-2026-78072 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-78072
Vulnerability Analysis
The Sexy Polling Reloaded extension fails to properly sanitize user-supplied input before incorporating it into SQL queries. Attackers exploit this weakness by injecting crafted payloads into request parameters processed by the extension. Because the injection is blind, attackers infer database contents from application behavior, response timing, or conditional responses rather than direct error output.
The extension executes queries against the Joomla database with the privileges of the Joomla database user. Successful exploitation grants attackers the ability to read arbitrary tables, including the Joomla #__users table containing password hashes and session data.
Root Cause
The root cause is missing or insufficient input validation and lack of parameterized queries in the extension's request-handling code paths. User-controlled parameters flow directly into SQL statements without prepared statements or escaping. This pattern maps to [CWE-89] and is a common failure mode in third-party Joomla components that construct queries via string concatenation.
Attack Vector
Exploitation occurs over the network against publicly reachable Joomla instances. No authentication, user interaction, or elevated privileges are required. An attacker sends HTTP requests containing SQL payloads to endpoints exposed by the Sexy Polling Reloaded extension. Boolean-based or time-based blind injection techniques allow attackers to enumerate schemas and exfiltrate data one bit at a time. Refer to the GitHub PoC Repository for technical context on the affected code paths.
Detection Methods for CVE-2026-78072
Indicators of Compromise
- Repeated HTTP requests to Sexy Polling Reloaded endpoints containing SQL syntax such as UNION, SLEEP(, BENCHMARK(, or conditional statements like AND 1=1.
- Anomalously long response times from poll-related URLs, consistent with time-based blind SQL injection.
- Web server access logs showing high request volume from a single source targeting extension parameters.
- Unexpected reads against the Joomla #__users or #__session tables in database audit logs.
Detection Strategies
- Deploy web application firewall (WAF) rules that identify SQL injection signatures targeting Joomla extension endpoints.
- Enable Joomla database query logging and alert on queries containing tautologies or time-delay functions issued by the extension.
- Correlate HTTP request patterns with database activity to detect blind injection attempts using response-time analysis.
Monitoring Recommendations
- Monitor outbound data volume from the Joomla application server for signs of large-scale extraction.
- Track failed authentication attempts following any suspicious activity, indicating attackers may have obtained credentials.
- Ingest web server, WAF, and database logs into a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-78072
Immediate Actions Required
- Upgrade Sexy Polling Reloaded to version 5.6.1 or later on all Joomla installations.
- Audit web server and database logs for indicators of prior exploitation before patching.
- Rotate credentials for the Joomla database user and any administrator accounts whose hashes may have been exposed.
- Restrict administrative access to the Joomla backend by IP allowlist where feasible.
Patch Information
Update to Sexy Polling Reloaded version 5.6.1 or later. Consult the GitHub PoC Repository and vendor release notes for patch details. Apply the update through the Joomla Extensions Manager and verify the installed version after upgrade.
Workarounds
- Disable or uninstall the Sexy Polling Reloaded extension until the patched version can be deployed.
- Deploy WAF rules blocking SQL injection payloads directed at the extension's URL paths.
- Enforce least-privilege permissions on the Joomla database user to limit the impact of successful injection.
# Configuration example: verify the installed extension version via Joomla CLI
php cli/joomla.php extension:list | grep -i "sexy polling"
# Example WAF rule concept blocking common blind SQLi patterns on the extension path
# (ModSecurity syntax - adapt to your WAF)
SecRule REQUEST_URI "@contains /index.php?option=com_sexypolling" \
"chain,deny,status:403,id:1002026,msg:'Block SQLi against Sexy Polling Reloaded'"
SecRule ARGS "@rx (?i)(union\s+select|sleep\s*\(|benchmark\s*\(|and\s+1=1)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
