Unauthenticated JCR-SQL2 Injection in Sulu CMS via Smart Content Category Filter

What happened

A SQL/JCR-SQL2 injection vulnerability was identified in Sulu's Smart Content QueryBuilder, located in src/Sulu/Component/Content/SmartContent/QueryBuilder.php. The component concatenates category identifiers taken from the public 'categories' query parameter directly into a JCR-SQL2 WHERE clause without validating that the values are numeric. On any public-facing page containing a category-filtered Smart Content block, an attacker can manipulate this parameter to alter the resulting query.

Technical cause

The root cause is improper neutralization of special elements used in a query command (CWE-89), specifically a lack of numeric validation on category identifiers before they are concatenated into a JCR-SQL2 query. Because the query is built through string concatenation rather than parameterized input, an attacker-controlled value in the 'categories' parameter can change the structure of the query that is executed against the content repository.

Why it matters

Exploitation does not require authentication and does not require any user interaction, since the vulnerable code path is reachable through a normal public page request. An attacker can use the flaw to infer or enumerate content-repository nodes, including content that has not been published, which may expose information not intended to be public. Separately, submitting malformed or deliberately expensive query fragments can degrade the availability of the affected site. The advisory explicitly states this injection path does not allow modification of repository data.

Who is affected

Any Sulu CMS deployment running an affected release that includes at least one public page with a category-filtered Smart Content block is potentially exposed, since no authentication is required to reach the vulnerable query logic.

Affected versions

The vulnerability affects sulu/sulu releases prior to 2.6.25 in the 2.6 line, and releases from 3.0.0 up to but not including 3.0.8 in the 3.0 line.

Fixes and mitigation

The vendor has fixed this issue in sulu/sulu versions 2.6.25 and 3.0.8. Sites running affected versions should upgrade to one of these fixed releases.

Recommended action

Administrators of Sulu CMS installations should update to version 2.6.25 (for the 2.6 line) or 3.0.8 (for the 3.0 line) as soon as possible. Prioritize this update for any installation that uses category-filtered Smart Content blocks on publicly accessible pages, given the unauthenticated, no-interaction attack path.