CVE-2026-78082 Overview
CVE-2026-78082 is an unauthenticated SQL injection vulnerability in the JoomShaper SP Property extension for Joomla, affecting versions prior to 4.1.4. The flaw resides in the property search and map filtering query builders, which concatenate raw request parameters into SQL WHERE and ORDER BY clauses without quoting or type casting. Affected parameters include zipcode, sorting, price_range_dropdown, and psize_range_dropdown. Remote attackers can execute boolean-based or time-based blind SQL injection to extract sensitive database contents. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated remote attackers can extract arbitrary database contents, including user credentials and property owner personal data, from Joomla sites running SP Property before 4.1.4.
Affected Products
- JoomShaper SP Property extension for Joomla, versions prior to 4.1.4
- Joomla sites exposing the property search endpoint
- Joomla sites exposing the map filtering endpoint
Discovery Timeline
- 2026-09-10 - CVE-2026-78082 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78082
Vulnerability Analysis
The SP Property extension builds SQL queries for its property listing and map filtering features by string concatenation. User-controlled HTTP parameters flow directly into the generated SQL statement without prepared statements, parameter binding, or explicit integer casting. An attacker crafts payloads in the zipcode, sorting, price_range_dropdown, or psize_range_dropdown parameters that alter the query logic.
Because the vulnerable endpoints are reachable without authentication, exploitation requires no account on the target site. Attackers typically use boolean-based blind techniques by observing response differences, or time-based blind techniques using database sleep functions when responses are uniform. The impact covers full database confidentiality and integrity within the privileges of the Joomla database user.
Root Cause
The root cause is missing input neutralization in the query builder logic. The ORDER BY clause is particularly problematic because prepared statements cannot parameterize column or direction identifiers, so the developer must apply strict allowlisting. In SP Property, neither allowlisting nor casting is applied to the sorting or range parameters before concatenation.
Attack Vector
An unauthenticated attacker sends HTTP requests to the SP Property search or map filter endpoints with malicious values in the affected parameters. Payloads targeting sorting can inject additional SQL clauses through ORDER BY manipulation. Payloads in zipcode, price_range_dropdown, or psize_range_dropdown inject boolean or time-based conditions inside the WHERE clause. See the JoomShaper SP Property Extension page for feature and endpoint context.
Detection Methods for CVE-2026-78082
Indicators of Compromise
- Web server access logs containing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, AND 1=1, or IF( inside zipcode, sorting, price_range_dropdown, or psize_range_dropdown parameters.
- Repeated requests to SP Property search or map filter endpoints from a single source with incrementing payload variations.
- Joomla database error entries referencing malformed ORDER BY or WHERE clauses tied to the SP Property component.
- Anomalous long-running database queries originating from the Joomla web user.
Detection Strategies
- Deploy web application firewall (WAF) signatures that inspect query strings and POST bodies for SQL metacharacters in the four affected parameters.
- Correlate request patterns with response-size or response-time deltas to identify blind SQL injection probing.
- Enable Joomla and MySQL general query logging on staging systems to baseline legitimate SP Property queries and alert on deviations.
Monitoring Recommendations
- Alert on HTTP 500 responses returned from SP Property search endpoints, which often indicate injection attempts breaking query syntax.
- Monitor database CPU and query latency spikes tied to the Joomla application user for signs of time-based extraction.
- Retain web access logs for at least 90 days to support retrospective hunting once the CVE is disclosed publicly.
How to Mitigate CVE-2026-78082
Immediate Actions Required
- Upgrade the JoomShaper SP Property extension to version 4.1.4 or later on all Joomla instances.
- Audit web and database logs for exploitation attempts against the zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters.
- Rotate credentials and secrets stored in the Joomla database if exploitation indicators are present.
- Restrict database user privileges granted to the Joomla application to the minimum required.
Patch Information
JoomShaper addresses the vulnerability in SP Property 4.1.4. Administrators should download the updated extension from the JoomShaper SP Property Extension page and apply the update through the Joomla Extension Manager. Verify the installed version under Extensions → Manage after the upgrade.
Workarounds
- Deploy a WAF rule blocking SQL metacharacters and keywords inside the four affected parameters until the patch can be applied.
- Temporarily disable the SP Property component in the Joomla Extension Manager if the property search feature is not business-critical.
- Restrict access to the property search and map filter endpoints by IP allowlist where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
