Blind SQL Injection in Gridbox's Blog Author

TL;DR

Balbooa shipped Gridbox 2.20.3.1 on 21 September 2026. It fixes a time-based blind SQL injection in the blog author parameter, which lives on the public front end of any Gridbox blog and needs no login. An attacker can read your database one answer at a time, which is slow but reaches everything in it.

Every version below 2.20.3.1 is affected, which is nearly every Gridbox site in the mySites.guru database. There is no CVE and no CVSS score yet, and the vendor filed it as “security hardening”. Update to 2.20.3.1 now. If you are still below 2.20.2, you have a bigger problem than this one, covered in our two earlier Gridbox posts.

Update, 8 October 2026: Gridbox 2.20.4.0 is now the version to install

Balbooa released Gridbox 2.20.4.0 with two more security fixes: a Cross-Site Request Forgery flaw in the language installation process and a tighter path check in the image preview, reported by Sergiy Tryzhychynskyi. Both affect 2.20.3.1, so the advice below to update to 2.20.3.1 is now out of date. Update straight to 2.20.4.0. The details are in Gridbox 2.20.4.0 Fixes a Language Install CSRF and an Image Path Check.

What the flaw is

Gridbox blogs let a visitor filter posts by author, with a URL like index.php?option=com_gridbox&view=blog&author=5. That author value went straight into a database query without being turned into a number or quoted first. When user input reaches a query as raw text, an attacker can stop describing an author and start writing SQL, and the database runs it.

The fix, visible by comparing the 2.20.3.1 release against 2.20.3, is a single change in the component’s router. The parameter is now cast to an integer before it reaches the query:

// Before (vulnerable): the author value is concatenated in as-is
->where('`id` = '.$query['author']);

// After (2.20.3.1): cast to an integer first, so only a number survives
->where('`id` = ' . (int) $query['author']);

The same casting was added to the neighbouring tag, app and id parameters in the router. Casting to an integer is the correct, complete fix for a numeric identifier: after it, author=5 AND SLEEP(10) becomes the number 5 and nothing else.

Why a blind injection still reads everything

This is a blind injection, so it does not print database rows back on the page. It is time-based, which is the patient variant. The attacker phrases each question so a true answer makes the database pause and a false answer does not, then reads the answer from the response time. “Is the first character of the admin password hash an a?” Wait and see. Then the second character, and the next account, and the next table.

It is slower than an injection that dumps rows in one response, and just as complete. Given time, a time-based blind injection reads usernames, email addresses, password hashes, session tokens and site configuration, and it does all of it without a single valid login.

Is my Gridbox site affected?

If any Joomla site you run has Gridbox below 2.20.3.1, yes. The current 2.20.3 build and the 2.20.2.3 build before it are both affected, and so is every older release. The fix is 2.20.3.1 and nothing lower.

What you should do right now

1. Update Gridbox to 2.20.3.1 on every Joomla site that runs it, through Joomla’s Update tab or the mySites.guru mass updater.
2. Confirm the version afterwards. Open System, Manage, Extensions on the site and check Gridbox reads 2.20.3.1, so a half-applied update does not leave you exposed.
3. Check your administrator accounts and users. A flaw that can read password hashes and session tokens is a route to account takeover, so look for accounts you did not create and sessions you do not recognise.
4. If you cannot update immediately, unpublish any front-end Gridbox blog view that exposes the author filter until you can, which removes the reachable path.

How do I find every Gridbox site I manage?

The awkward question after any extension flaw is which of your sites actually run the thing. Past a handful of sites, logging into each Joomla admin to read the extensions list is not realistic, and that is exactly how old versions stay in place.

mySites.guru keeps a live inventory of every extension, template and framework on every connected Joomla and WordPress site. Search for Gridbox once and get back every site running it, the version each is on and whether an update is waiting. Across the Joomla sites we manage, several hundred run Gridbox, which is a lot of sites to reach one at a time.

We have added the affected range, every version below 2.20.3.1, to our vulnerability database, so every connected site still on a vulnerable Gridbox is flagged automatically, and the mass updater pushes 2.20.3.1 to all of them from one screen. Finding and fixing the whole set is part of the subscription, not a separate purchase.

The third Gridbox security story in two months

This is the third security release for Gridbox since July. The authentication bypass came first, fixed in 2.20.1. Then Balbooa asked us to audit the extension and we reported twenty-three vulnerabilities, fixed in 2.20.2, several of which were already being exploited. Now an outside researcher, Studio Przy Lesie, has brought this SQL injection to Balbooa, with Cert.pl identifying it, fixed in 2.20.3.1.

An extension getting fixes is a sign of attention, and the same Media Manager code has been hardened across Balbooa’s Forms and Gallery products in the same window. The lesson for a site owner is to stay current, because a popular page builder is a large attack surface. The sites that get hurt are always the ones a version or two behind when the next one arrives.

No CVE, no CVSS, no advisory with a range

We did not find this flaw, so we will stick to what the disclosure tells a site owner. Balbooa’s note names the vulnerability type and thanks the reporters, which is more than the July authentication bypass changelog managed. It still ships with no CVE, no CVSS score and no statement of which versions are affected or whether the flaw is reachable without a login. A site owner reading it cannot tell how urgent it is or which of their sites are in scope.

That gap is why we confirmed the vulnerable parameter and the fix ourselves, and set the affected range so the sites we manage are flagged correctly today rather than whenever a CVE catches up. Cert.pl is a CNA, so a record may follow; if it does, we will map it.

Stay ahead of the next one

Extension flaws arrive too often to handle one at a time: there has been one for Gridbox roughly every three weeks since July, and that is one extension among the dozens on a typical Joomla site. mySites.guru watches the whole set, flags a site the moment a version it runs becomes known-vulnerable, and lets you update everything from one place.

If a site has already been hit, or you would rather someone else make sure, fix.mySites.guru patches the site, audits it for backdoors and returns it secure for a single fixed fee, usually the same day. Non-subscribers get a free month with it.

Disclosure and severity

There is no CVE and no published CVSS score for this flaw as of 21 September 2026. Our own assessment is High: the injection is unauthenticated, reachable on the public front end of any Gridbox blog, and can read the entire database, which is limited only by an attacker’s patience rather than by any access control. We are treating it with the same urgency as an equivalent scored flaw because “no number yet” is not the same as “not serious”.

Credit for the finding goes to Studio Przy Lesie for reporting it and Cert.pl for identifying it, per Balbooa’s release note. The fix is Gridbox 2.20.3.1.