CVE-2026-76602

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Published Aug 22, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

Analysis

Technical impact

Unauthenticated SQL injection is present in the Fabrik extension for Joomla when the order parameter in list models is used without validation. Attackers can supply arbitrary ORDER BY clauses to the database, allowing read SQLi vectors. The underlying weakness is a classic SQL injection flaw (CWE-89) that allows unauthenticated users to read data from the database through crafted web requests.

Affected Systems

Fabrik extension for Joomla, supplied by fabrikar.com, is affected in versions earlier than 4.7.2. Joomla sites deploying any Fabrik build below 4.7.2 expose this vulnerability and must update to the latest release to receive the patch that validates the order parameter.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating critical impact. EPSS is unavailable, but the lack of authentication requirement and remote exploitation via standard web requests mean the risk is high. Since the vulnerability is not listed in CISA's KEV catalog, no known exploits are recorded yet, but the attack vector is plausible for any publicly accessible Joomla site using the vulnerable Fabrik extension.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

fabrikar.com

Fabrik extension for Joomla

unaffected

Version	Status	Constraints
`1.0.0-4.7.1`	affected	—

No data.

Vendor Product Versions

Fabrikar.com

Fabrik Extension For Joomla

Version	Status	Scheme	Platform
`[1.0.0,4.7.3]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Fabrik extension to version 4.7.2 or later, which includes input validation for the order parameter.
If an immediate update is not possible, block or filter the ORDER BY input using a web application firewall or server rule to remove unsanitized order clauses.
Review and disable any unused list models or parameters that expose the vulnerable order field to reduce the attack surface.

Generated by OpenCVE AI on August 23, 2026 at 12:50 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.386% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.fabrikar.com/

History

Aug 24, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 23, 2026 11:00 AM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.	Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
Title	Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3	Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Aug 22, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fabrikar.com Fabrikar.com fabrik Extension For Joomla
Vendors & Products		Fabrikar.com Fabrikar.com fabrik Extension For Joomla

Aug 22, 2026 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
Title		Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3
Weaknesses		CWE-89
References		https://www.fabrikar.com/
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`