CVE-2026-49048: Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1
The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.
Metrics
- CVSS v3.1
- 9.8
- Severity
- CRITICAL
- Fixed in
- —
- Affected Products
- 1
HarborGuard Analysis
Synopsis
An unauthenticated SQL injection vulnerability affects the JoomCCK extension for Joomla (versions 1.0 through 6.4.0), developed by joomcoder.com. A remote attacker with no credentials can reach the vulnerable front-end controller task over the network and inject arbitrary SQL by supplying a crafted request parameter, because the extension concatenates user input directly into SQL queries without escaping or parameterisation. Successful exploitation gives the attacker full read, write, and denial-of-service capability against the underlying database. No upstream fix has been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment a fix version is released.
HarborGuard Coverage
Detection of CVE-2026-49048 is available across every HarborGuard environment: the CVE is ingested from upstream advisory feeds within minutes of publication and matched against all customer images, including custom-built images that bundle the JoomCCK extension. Any image in a connected registry or CI pipeline containing an affected version (1.0-6.4.0) is flagged automatically.
AvailableHarborGuard is capable of scoring this CVE at its published CVSS v3.1 rating of 9.8 (Critical) and weighting it against each environment's compliance policy to determine urgency. Triage findings are routed to the appropriate team inbox within each customer organization based on configured ownership rules for Joomla-based workloads.
AvailableBecause no fix version has been published upstream, HarborGuard re-evaluates the advisory on every ingest cycle and will make a patched-image rebuild available automatically the moment joomcoder.com ships a remediated release. For customers who opt into auto-remediation, the rebuild, regression-test run, and PR against affected workloads will be triggered without manual intervention as soon as the fix is available.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The vulnerable controller task is exposed over the network; an attacker must be able to send HTTP requests to the Joomla front end to reach it.
- AuthenticationNot required
No account or session token is needed; the injection point is accessible to any anonymous HTTP client.
- Victim interactionNot required
The attack is fully server-side; no user action or social-engineering step is required.
- Attack complexityDetail
Exploitation is reliable and condition-free; no race condition, memory-layout dependency, or special environmental state is required to trigger the injection.
Blast Radius
- Reads any data the database account can access, including stored user credentials, session tokens, and application content.
- Writes or modifies persisted database rows, enabling content tampering, privilege escalation within the application, or insertion of malicious data.
- Drops or corrupts tables and data, causing the Joomla site and dependent services to become unavailable.
- Depending on database server configuration, may allow file-read or file-write operations on the host filesystem via SQL-level functions.
How HarborGuard Handles This
Available on HarborGuard: because no upstream patch exists for CVE-2026-49048 at this time, HarborGuard monitors the joomcoder.com advisory on every ingest cycle and will surface a patched-image rebuild the moment a fix version is published. For environments with auto-remediation enabled, the rebuild, regression run, and PR will be triggered automatically without requiring manual action. In the interim, compensating controls are recommended: apply a web application firewall rule to block or sanitize requests to the affected front-end controller task, enforce network policy to limit inbound access to Joomla instances to known IP ranges where operationally feasible, and consider disabling the JoomCCK extension entirely if it is not actively required. HarborGuard will re-triage affected images each cycle so that teams receive updated findings if the risk posture changes before a patch is available.
- joomcoder.com / JoomCCK extension for Joomla1.0-6.4.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H