CVE-2026-56292

CRITICAL

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-56292 has a selected CVSS score of 9.2 (critical); EIP currently links 1 repository PoC.

Description

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 9, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

acymailing.com AcyMailing extension for Joomla

Browse acymailing.com / acymailing.com AcyMailing extension for Joomla

Default status: unaffected

CVE List1.0-10.11.0affected

Proofs of concept

1

Repository PoCs

GitHubnullwhisper/CVE-2026-56292-AcyMailing-SQLiRepository PoCby nullwhisper0Scanner7 files

16.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python-based mass scanner that sends a crafted SQL injection payload to a specific Joomla AcyMailing endpoint and classifies targets as vulnerable, patched, or error based on the response, without extracting or dumping database contents beyond a version string.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward SQL injection scanner for CVE-2026-56292. It sends a crafted request to a target Joomla endpoint and parses the response to determine vulnerability. All code is readable and directly serves the disclosed exploit. No concealed payloads, data exfiltration to third parties, or deceptive behavior was found.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareAcyMailing for Joomla
Attack typessql injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code sends a SQL injection payload but only extracts the database version string to determine vulnerability; it does not exfiltrate data, establish a shell, or perform any post-exploitation actions. The README describes it as a 'single + mass scanner' and the script's output is limited to classification and version reporting.

README.md:18cve_2026_56292_acymailing_sqli.py:3cve_2026_56292_acymailing_sqli.py:36cve_2026_56292_acymailing_sqli.py:72-85

Requirements

  • Target must have AcyMailing component installed and the frontentityselect task accessible.cve_2026_56292_acymailing_sqli.py:7-8

Observed behavior

  • Sends a GET request with a UNION SELECT version() payload in the columns parameter to the loadEntityFront endpoint.cve_2026_56292_acymailing_sqli.py:35-36cve_2026_56292_acymailing_sqli.py:61-69
  • Parses the JSON response to extract a non-numeric id field as the database version string, indicating vulnerability.cve_2026_56292_acymailing_sqli.py:72-85
  • Classifies responses as vulnerable, patched, error, or safe based on HTTP status and response body keywords.cve_2026_56292_acymailing_sqli.py:88-141
  • Supports single target and mass scanning with multi-threading, output files for vulnerable/patched/error targets.cve_2026_56292_acymailing_sqli.py:192-205cve_2026_56292_acymailing_sqli.py:231-257
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
index.php?option=com_acym&ctrl=frontentityselect&task=loadEntityFrontThe vulnerable endpoint targeted by the exploit.cve_2026_56292_acymailing_sqli.py:35
Payload
id FROM #__acym_user AS user UNION SELECT version()#The SQL injection payload used to extract the database version.cve_2026_56292_acymailing_sqli.py:36
Review boundaries

What the analysis did not establish

  • Evidence does not include the TECHNICAL.md writeup file referenced in README.md; only README.md, the scanner script, and requirements.txt are provided.
  • The repository contains 7 files total but only 3 text files are included; 4 files are omitted, including dorks.txt and LICENSE.
  • The scanner script is not executed; classification is based solely on static analysis of the provided source code.
  • Four files from the repository (dorks.txt, TECHNICAL.md, LICENSE, and a .gitignore) were not included in the text evidence, but their metadata and names are consistent with the disclosed project and do not suggest executable behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3