V6.4.1 mod_tag_cloud Shows only 0

[LordHelmchen666]

Since Update to 6.4.1 mod_tag_cloud Shows only 0 instead of the Tag names.
You can see it here https://www.rezept-community.de/rezepte/rezepte
Strange Thing is on other site it works as expected. Any idea what could be the issue?

[andiamine]

i think last security updates did this, i will check and update you

[LordHelmchen666]

Thank you. I ask gemini and answer was it could be an SQL Problem with cast int and string. But dont know how much we can trust AI.

[LordHelmchen666]

I asked Gemini and it was completely right answer!

Here is the English translation of the response, formatted and structured specifically so you can copy and paste it directly as a GitHub issue or discussion:
Issue: Tag Cloud Module Outputs "0" and SQL Injection Payloads
Description

The JoomCCK Tag Cloud module is rendering tags named 0 as well as raw SQL injection strings (e.g., ))) AND 31=75#). This is not a CSS or template rendering bug, but a critical data-integrity and potential security issue.

Below is the rendered HTML output showing the infected tags:
HTML

<li class="tag_element" id="tag-3">
    <a href="..." ...>
        <small class="tag">))) AND 31=75#</small>
    </a>
</li>

Cause Analysis

The string ))) AND 31=75# is a classic SQL Injection (SQLi) payload commonly used by automated vulnerability scanners (like sqlmap) searching for security exploits.

There are two likely vectors for how these entries ended up in the database table (#__js_res_tags):

The "Auto-Create Tags" Feature (Highly Likely):
If JoomCCK is configured to automatically generate and save new tags based on user search queries or filter submissions, automated bots scanning the site's search fields will unintentionally trigger the creation of these tags. The component sanitizes the input enough to prevent immediate database damage, but unfortunately saves the raw malicious string as a valid new tag.

Direct SQL Injection Vulnerability:
There might be an unpatched vulnerability in JoomCCK (or an associated plugin) allowing unauthorized database writes to the tag table.

Step-by-Step Resolution
Step 1: Clean the Tag Database Table

The database must be cleaned of these automated "junk" tags:

In the Joomla Backend, navigate to JoomCCK -> Tags.

Search for tags named 0 or containing special characters such as ), #, or AND and delete them permanently.

Alternatively via phpMyAdmin: Run the following SQL query on your Joomla database to inspect and remove suspicious tags:
SQL

DELETE FROM `#__js_res_tags` 
WHERE `tag_name` = '0' 
   OR `tag_name` LIKE '%)%' 
   OR `tag_name` LIKE '%#%';

(Replace #_ with your database prefix, e.g., j25_).

Step 2: Restrict Tag Creation Permissions

To prevent bots from injecting new tags through search or submission forms:

Open your JoomCCK Tag Field settings.

Disable options like "Auto-create tags" for public visitors or search parameters.

Ensure that only authorized User Groups (e.g., Authors, Editors, Admins) have the permission to create new tags on the fly.

Step 3: Site Hardening & Security Audit

Because active SQL injection attempts were detected on this site, the following security measures are highly recommended:

Ensure Joomla and JoomCCK are updated to their latest secure versions.

Implement a Web Application Firewall (WAF) such as Akeeba Admin Tools Pro to block SQLi payloads at the application entry point before they reach the JoomCCK router.

[LordHelmchen666]

After more investigation i guess the SQL Injection happened shortly before upgrading to 6.4.1. Couldn't say it for sure. So maybe we should keep having an eye on it.

EDIT: It is clear now. Happend before update to 6.4.1.