Gridbox EUVD-2026-110645

Exploitation requires the target Joomla site to have a published Gridbox store/product list page that exposes the sort-by URL parameter; this is the specific feature whose input is passed to GridboxHelper::getBlogPosts() and concatenated into the ORDER BY clause. No authentication, no user interaction, and no special configuration beyond having such a store/product listing page reachable are needed (PR:N/UI:N/AC:L). The practical limiting factor is deployment-specific: sites running Gridbox without a store/product list page, or on versions 2.20.4.2 and later, are not exposed; realistic impact is constrained to data extraction because the ORDER BY position generally precludes stacked data-modifying queries under Joomla's MySQLi driver.

This is a genuine priority despite a modest EPSS score. The signals mostly align upward: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a fully remote, low-complexity, unauthenticated attack with no user interaction, which is why the base score is 9.3 (Critical) and why the vuln.today Decision label is act_now. CWE-89 (SQL injection) reaching the ORDER BY clause with no allowlist is a classic pre-authentication data-exposure primitive. The one conflicting signal is EPSS: 0.39% (32nd percentile) is low and indicates there is no observed mass-exploitation activity yet, and the CVE is NOT on the CISA KEV list, so this is 'critical by design/severity' rather than 'critical because it is being hammered today.' Interpretation: the low EPSS reflects absence of a public weaponized exploit and the niche footprint, not a weakness in the vulnerability itself - a single crafted request suffices once an exploit is written. One caveat on the vendor-supplied impact metrics: the input vector claims VI:H and VA:H, but an ORDER BY-clause injection on Joomla (MySQLi driver) typically does not permit stacked write/DELETE queries, so realistic impact is heavily weighted toward confidentiality (blind data extraction) rather than integrity/availability - verify write impact with the vendor before assuming full database compromise.

An unauthenticated remote attacker browses a Joomla site that publishes a Gridbox store/product list page, then appends a crafted value to the sort-by URL parameter that does not match any known sorting key. Because the value is prefixed with a table alias and placed directly into the ORDER BY clause with no allowlist check, the attacker uses blind/boolean or time-based techniques to extract database contents such as user records and session data. No public exploit code was identified at time of analysis, so initial exploitation requires the attacker to develop the payload.