Description
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
balbooa.com Gridbox extension for Joomla
Default version status: unaffected
1.0.0-2.20.4.1affected