SP Page Builder vulnerabilities

Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.

Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated SQL injection vulnerability. Improper validation of catid parameters in the loadMoreArticles endpoint allows an attacker to execute SQL queries.

The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.

An unauthenticated stored XSS vulnerability in SP Page Builder (< 6.7.0) for Joomla allows an attacker to store malicious JavaScript in the site's database via a single HTTP request. When an administrator opens the editor, the script executes automatically.

The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 allows an authenticated user to delete arbitrary files due to improper path validation and ACL checks in the media manager.

The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 contains an SQL injection vulnerability in the search and date filters of the media manager, allowing an authenticated user to manipulate database queries.