Joomla! Component Sponsor Wall 8.0 SQL Injection

Published 4 mo ago 2026-06-19 · modified 2 mo ago 2026-08-19 · JSON

CVSS

7.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.5%

percentile 39%

Public exploits

none known

Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_sponsorwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information including credentials and configuration data.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 4 mo ago 2026-06-22

Exploit prediction (EPSS)

0.45% probability of exploitation in the next 30 days, higher than 39% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	7.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`
CNA	3.1	7.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`
CNA	4.0	7.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	7.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`

Affected products

Pulseextensions Sponsor Wall

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

exploit-db.com /exploits/42525 · exploit
pulseextensions.com / · product
extensions.joomla.org /extensions/extension/ads-a-affiliates/sponsors/sponsor-wall/ · product
vulncheck.com /advisories/joomla-component-sponsor-wall-sql-injection · third-party-advisory

Sources

CVE List: CVE-2017-20264
NVD: CVE-2017-20264

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary