External risk intelligence

DJ-Classifieds Unauthenticated SQL Injection in Frontend Search.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-105604

The vulnerability exists in a frontend search function of a Joomla extension. Frontend components of web-based content management systems are designed to be public-facing and accessible to anonymous users over the internet by default to facilitate site functionality.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in a Joomla extension, DJ-Classifieds, that could allow unauthenticated attackers to execute SQL injection attacks through the frontend search feature. This type of attack can compromise the integrity and availability of the underlying database.

Unauthenticated search feature allows database compromise.
Critical SQL injection risk in a public-facing component.
Confirm relevance; assess potential data integrity impact.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability without any authentication by targeting the frontend search feature of the DJ-Classifieds Joomla extension. Successful exploitation allows the attacker to inject malicious SQL code into database queries, potentially leading to unauthorized access, modification, or deletion of sensitive data.

Unauthenticated network access
Frontend search functionality
Unauthorized data access and manipulation

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in the DJ-Classifieds Joomla extension could allow an unauthenticated attacker to manipulate database queries through the frontend search functionality. When supported, this could potentially lead to unauthorized access or modification of sensitive data stored within the application's database.

Database integrity and confidentiality.
Via unauthenticated search input.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in the DJ-Classifieds Joomla extension impacts the frontend search functionality, making it a critical concern for site owners. Initial triage should focus on identifying all instances of the affected extension, confirming its reachability and business criticality, and assigning ownership to the appropriate team for remediation planning.

Joomla extension owners should coordinate remediation.
Verify public-facing search accessibility and criticality.
Plan vendor engagement and targeted patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DJ-Classifieds extension for Joomla?

DJ-Classifieds is a specialized plugin used within the Joomla content management system to create classified ad marketplaces. It allows site owners to display product listings, manage categories, and provide users with search tools to find specific items on the website.

What does SQL injection mean in the context of CVE-2026-105604?

This vulnerability, classified as CWE-89, occurs when an application fails to properly sanitize user input before including it in a database command. In this case, an attacker can input malicious SQL code into the search field, tricking the database into executing unauthorized commands that could compromise sensitive data.

How is the search feature triggered by an attacker?

An attacker triggers this vulnerability by sending specially crafted search queries to the DJ-Classifieds frontend. Notably, the vulnerability requires no special user privileges or account login; it is triggered simply by interacting with the search function. Standard, non-malicious site searches do not trigger the bug.

Is my site at risk if I use DJ-Classifieds?

According to Halo Surface Signal, this vulnerability is very likely to be reachable because it exists in a frontend component designed for public access. If your Joomla instance uses this extension and is accessible over the internet, your site's database is potentially reachable by unauthorized users.

What steps should I take if I run this software?

Begin by identifying all Joomla sites in your environment using the DJ-Classifieds extension. Assess whether the extension is running a version earlier than 3.11.3. Prioritize these instances for remediation, coordinate with your technical team, and check the vendor's website for official updates or patches.

References

dj-extensions.com/dj-classifieds

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.