Balbooa Gridbox: Unauthenticated SQL injection in store product list sorting
Summary
Balbooa Gridbox, a website builder extension for Joomla, is affected by an unauthenticated SQL injection flaw. The sort-by URL parameter on store product list pages is inserted into an ORDER BY clause without an allowlist check. A remote attacker without a login can manipulate database queries, which may expose or change site data.
Affected
- Gridbox for Joomla 1.0.0 to 2.20.4.1 (per Strix and the CVE description)
- Versions below 1.0.0 are not stated in the sources.
Fixed in
- Gridbox 2.20.4.2
- The Balbooa changelog for this CVE was not found; verify the fixed version before rollout.
Workaround
- No workaround is documented in the sources.
- If an update cannot be applied immediately, restrict access to affected store pages where possible.
Exploitation
- No public exploit is known (VulDB).
- OffSeq reports no known exploitation in the wild; not confirmed by CISA or the vendor.
Our recommendation
- Update Gridbox to 2.20.4.2 or later without delay.
- Check whether older Gridbox builds remain on any Joomla site and update them too, as other unauthenticated Gridbox CVEs affect versions below 2.20.2.
- Review web server logs for unusual sort-by parameter values and review store and blog pages for signs of abuse.
- Prioritise internet-facing sites.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Strix CVE record CVE-2026-102788 www.strix.ai
- VulDB entry 427088 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- Balbooa Gridbox product page www.balbooa.com
- Balbooa Gridbox 2.20.2 security release www.balbooa.com
- mySites.guru vulnerabilities overview mysites.guru
- CVE record mirror (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:37.
Original description (NVD)
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.