JC Tables (Joomla): Unauthenticated SQL injection in read and write queries

Summary

JC Tables, a Joomla data-table extension from JoomCode, has an unauthenticated SQL injection flaw in its front-end CRUD API. Table names, column names and values from request parameters are concatenated into SQL queries without authentication or token checks. An unauthenticated remote attacker can read any table in the Joomla database, including user password hashes, and write to tables; the research describes a path to remote code execution as the web server user.

Affected

• JCTables extension for Joomla, versions below 1.21.1 (NVD and CNA range 1.0.0 to 1.20.0; lower bound not independently verified)
• Confirmed by the researcher on 1.10.31.2 (Free edition); paid editions not documented

Fixed in

• Fixed in JCTables 1.21.1 (released 2026-08-05), which adds a token check to front-end data-changing tasks
• Unknown whether a later 1.21.x release exists; check the vendor download page

Workaround

• No vendor-documented workaround.
• Uninstall JCTables if it is not used.
• Block the front-end component endpoints (option=com_jctables) at the web server or WAF; verify this does not break required functions first.

Exploitation

• Public proof of concept published on GitHub; it is reported to demonstrate reading data.
• No in-the-wild exploitation reported as of the sources reviewed.
• Not listed in CISA KEV. CISA SSVC lists exploitation as none, automatable as yes, technical impact as total.

Our recommendation

• Check whether JCTables is installed and which version is used; update to 1.21.1 or later immediately.
• If an affected version was reachable from the internet, review web logs for unauthenticated requests to com_jctables and treat the site as potentially compromised.
• Rotate Joomla administrator and database credentials after patching if exposure is possible.
• Remove JCTables if it is not needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  murrez/CVE-2026-76570

Research sources

• VulnCheck research: JCTables for Joomla www.vulncheck.com
• Original researcher write-up chocapikk.com
• VulnCheck status update docs.vulncheck.com
• CVE record mirror (OpenCVE) app.opencve.io
• Public proof of concept (GitHub) github.com
• JoomCode vendor website www.joomcode.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:45.