EUVD-2026-87771
GHSA-6c54-6qx7-xwjj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Joomla site with YouTube Gallery ext
-
ExploitSend crafted search/sort parameter
-
ExecutionInject SQL into read query
-
ImpactExtract database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the target Joomla site has the joomlaboat.com YouTube Gallery extension installed at a version below 5.7.3 with its video gallery/search feature reachable. Exploitation targets the video search functionality and the sorting parameters, so those front-end features must be exposed (they are the extension's primary purpose and typically public). No authentication, no user interaction, and no non-default configuration are needed. The main limiting factor is deployment scope - only sites running this specific third-party extension are affected; core Joomla installs without it are not vulnerable. |
| Impact | This is a genuine high-priority vulnerability class: an unauthenticated, network-reachable SQL injection (CWE-89) in a Joomla extension. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates remote exploitation with no privileges, no user interaction, and low complexity - the worst-case profile for an SQLi. My independent assessment agrees the confidentiality impact is high (full DB read via injection in read queries), but the description explicitly scopes the flaw to 'read queries,' which tempers the VI:H/VA:H claimed by the vendor; write/DoS impact via SQLi is possible but not evidenced here, so integrity/availability are better treated as low-to-uncertain. Critically, exploitation-signal data is absent: no EPSS score, no CISA KEV listing, and no public POC are provided. Per precision rules this is 'no public exploit identified at time of analysis' - the 9.3 reflects exploitability potential, not confirmed real-world exploitation. Net: technically severe and easy to weaponize if a POC emerges, but current active-exploitation risk is unquantified and the real-world blast radius is bounded by the extension's modest deployment footprint. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a Joomla site running the YouTube Gallery extension (< 5.7.3) and submits crafted input to the video search or sorting parameters, injecting SQL into the backend read query. Because no authentication or user interaction is required, the attacker can extract database contents such as user records, session data, and password hashes. No public exploit code is identified at the time of analysis, but the injection is low-complexity and typical of tooling-friendly SQLi. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
RemediationAI
Update the YouTube Gallery extension to version 5.7.3 or later - the vendor-released patch is 5.7.3, published via https://joomlaboat.com/youtube-gallery, and it should be installed through Joomla's extension installer followed by a cache purge. If the update cannot be applied immediately, unpublish or disable the YouTube Gallery extension, which fully removes the attack surface at the cost of losing the video gallery feature; a less disruptive intermediate step is to restrict public access to the extension's search and sort endpoints (for example via a WAF rule blocking SQL metacharacters and UNION/SELECT patterns in the search and order parameters, or by placing the gallery behind authentication), though WAF filtering must be tuned because legitimate video titles containing apostrophes or quotes will trigger false positives and the rule set will need review after any parameter change. Because the injection targets read queries and may have exposed Joomla user password hashes and database credentials, treat any site that ran an affected version with public search enabled as potentially compromised: rotate the Joomla database password, reset administrator credentials, and review web and database logs for anomalous SELECT patterns or UNION-based requests against the gallery URL before declaring the site clean.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled input from the extension's video search field and sort/ordering parameters is concatenated into SQL statements without parameter binding or proper escaping. Because the vulnerable queries are read (SELECT) statements executed against the site's Joomla/MySQL (or MariaDB) database, the practical exploitation path is data exfiltration rather than direct write - matching the assessed vector, where confidentiality is High while integrity and availability are only Low. Joomla extensions run in-process with the CMS and share its database credentials, so a successful injection can typically be leveraged to read sensitive tables such as #__users (password hashes, email addresses, privilege levels), session or extension configuration data, and potentially other application tables reachable by the Joomla database user. The CPE cpe:2.3:a:joomlaboat.com:youtube_gallery_extension_for_joomla:*:*:*:*:*:*:*:*: identifies every version of the extension prior to 5.7.3 as affected; the plugin is a third-party component, so the vulnerability surface is entirely within the extension's front-end search and sorting handlers rather than Joomla core.
Know when Youtube Gallery Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) with full DB read (C:H); description limits impact to read queries, so I:L/A:L rather than high.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries.
Executive ViewAI
A critical, unauthenticated SQL injection flaw in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) allows any internet user to read data directly from the site's database without credentials or user interaction. Only sites running this third-party extension are exposed - core Joomla installations are unaffected - but for affected sites this is a direct path to disclosure of customer, member, or administrative data. With no vendor-released patch identified and the vulnerable gallery page being publicly reachable in its normal deployment state, leadership should treat any site running this component as an active data-exposure risk.
No vendor-released patch identified at time of analysis. Interim mitigations: unpublish or disable the YouTube Gallery extension (or take the affected gallery front end offline) on all sites running versions below 5.7.3; deploy WAF or virtual-patching rules that block SQL-injection patterns on the video search and sorting parameters; restrict network access to those endpoints to trusted sources; monitor and review database and web logs for anomalous read activity; and rotate credentials or secrets potentially exposed via database read. Confirm remediation guidance with the vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB