EUVD-2026-64327
GHSA-49rr-hfxh-8f4c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SQL injection in a SELECT WHERE clause yields full database read (C:H), but the description indicates read-only impact so I:N/A:N; low complexity, no privileges or interaction.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
AnalysisAI
Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixed in 4.7.3) lets remote attackers read the entire backing database. The flaw sits in getFilterQuery(), where the user-controlled list-filter 'condition' parameter is concatenated verbatim into a WHERE clause, so no authentication or user interaction is needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Joomla site has the Fabrik extension installed at a version at or below 4.7.3 and exposes a Fabrik list whose filter functionality is reachable by the attacker; the specific trigger is supplying a crafted value in the list filter's 'condition' parameter, which reaches getFilterQuery() and is concatenated into the WHERE clause. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority, easily exploitable flaw for anyone running Fabrik. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker browses to a public Joomla page rendering a Fabrik list, then manipulates the list-filter request so the 'condition' parameter carries crafted SQL (e.g., a UNION-based or boolean/time-based payload). Because the value is concatenated straight into the WHERE clause, the attacker extracts arbitrary tables - Joomla user records, session tokens, and configuration secrets. … |
| Remediation | Upgrade Fabrik to version 4.7.3, which per the affected-range data ('< 4.7.3') is the first fixed release - cite the vendor at https://www.fabrikar.com/ for the release, as no dedicated advisory URL was provided in the input and the exact patched build should be confirmed with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Fabrik extension versions prior to 4.7.3, prioritize those handling sensitive or customer data, and prepare emergency patching procedures with change management approval. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabrik Extension For Joomla
View allRemote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today