Staff replied SP Page Builder

problems with assets remaining following recent vunerability holes

Asked by Lorna Guttormson 2 months ago Last activity 2 months ago

Our site has had extremely slow response today - up to 13 seconds to display a page and high resource usage. I have spent much of the day tracking this down with the help of ChatGPT. Here is a summary of history and our findings:

Joomla 6 site.
SP Page Builder upgraded from 6.6.2 to 6.7.0.
Site was rebuilt from clean source after a previous compromise.
Security scan (WebHosting Canada Safe Site) is clean.
Front end appears normal.
Apache logs show many 404s for missing files such as:
/media/com_sppagebuilder/assets/iconfont/icovxkyvg/style.css
/media/com_sppagebuilder/assets/iconfont/icotagluk/style.css
The files do not exist on disk.
test2_sppagebuilder_assets contains matching records:
- an example of the missing assets -
  id: 15
  type: iconfont
  name: icovxkyvg
  title: icovxkyvg
  assets: ['ico ico-x']
  css_path: media/com_sppagebuilder/assets/iconfont/icovxkyvg/...
  created: 2026-06-22 12:12:59

It seems many of these should be deleted from the database - but perhaps not all . Are these orphaned custom iconfont records? Is there a supported way in SP Page Builder 6.7.0 to regenerate missing iconfont assets, or should unused rows in #__sppagebuilder_assets be removed?

What should I do now to move forward?

6 replies

Atick Eashrak Shuvo Staff

2 months ago

I apologize for the inconvenience caused. Could you please check now and let me know if the issue is resolved on your end?

Looking forward to your response.

Best regards

Paul Frankowski Senior Staff

2 months ago · edited

Hi Lorna,

you forgot about two basic things:

Update to last version 6.7.1
Scan site using our MuRu scanner (github) and clean infection, update will not remove files uploaded by hackers. This is general rule for all extensions in Joomla. Worth to remember.

basic guide: https://www.joomshaper.com/documentation/sp-page-builder/troubleshooting#how-to-clean-an-infected-joomla-4x-6x-site

Lorna Guttormson Asked this

2 months ago

That has fixed our test system - but I had not addressed the prod system to you as it seemed the same problem . I have now updated our prod site to 6.7.1 but it is still very slow. I see that all but the first record has been removed from test2 sp-pagebuilder_assets. Should I be doing the same on our production or is there something more you have done?

Lorna Guttormson Asked this

2 months ago

Thank you for your help . I have now deleted the many asset entries and many .htaccess files. I haven't run your utitlity from github as I don't know how to download the file directly from the dist directory - I see no download option. Could you send directions?
Our prod site is running smoothly now.

Paul Frankowski Senior Staff

2 months ago · edited

There is, just click on file name ;]

anyway here is direct link >> https://github.com/zkrana/joomla-security-scanner/blob/main/dist/com_muruguard-2.7.1.zip

then install it inside joomla, like any other component, then find it on left menu

Lorna Guttormson Asked this

2 months ago

Thank you for this. My scan shows some problems that I think I understand the cause but would like to check with you before I proceed. The scan indicates shaper helix and cassiopiea (and also com_search) have no matching #extensions. I think this is likely because of the way I restored my site. I created a complely new site starting with pitech_quickstart_j6 with a new database. When I was confident that all was working I then, only then, connected to my production database.

My question - do I need to start again to fix this or is there some way to introduce these 3 to my database - perhaps with entries to the #_extensions?

Paul Frankowski Senior Staff

2 months ago

If inside database you have some old tables, no problem, it's not security problem. Only old php code can make a real problem.

You can manually remove tables from prefix_extensions - but you are doing it on your own risk.