The SP Page Builder extension for Joomla (versions 5.2.1 to 6.9.0) contains an authenticated SQL injection vulnerability in the Content Plugin. The onContentAfterSave() method reads the jform[attribs][sppagebuilder_article_id] parameter from the request and concatenates it directly into a SQL WHERE clause without quoting or type casting. Joomla's ARRAY input filter does not sanitize element values, allowing the entire malicious payload to be delivered in a single POST field. This vulnerable code executes on every onContentAfterSave event regardless of the triggering component, enabling an attacker with privileged access to perform time-based blind SQL injection to extract arbitrary database data, including sensitive user and session information.

An attacker with authenticated privileged access can exploit this vulnerability to perform time-based blind SQL injection attacks, potentially extracting sensitive database information such as user credentials and session data. This could lead to unauthorized data disclosure and compromise of the Joomla site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged user access to trusted individuals only and monitor for unusual activity related to the SP Page Builder extension. Avoid using vulnerable versions if possible.