Joomla OSDownloads 1.7.4 contains an SQL injection flaw that permits unauthenticated attackers to inject arbitrary SQL through the id parameter in the item view. By sending specially crafted GET requests to index.php with the query string option=com_osdownloads&view=item&id=[SQL], an attacker can read sensitive database contents, including user credentials and configuration data, potentially compromising site integrity or enabling further attacks if write access is present.

The vulnerability affects the OSDownloads component created by Joomlashack, specifically version 1.7.4 that runs under Joomla CMS. Any site that has installed this exact version and exposes the item view without input validation is susceptible.

The CVSS score of 8.8 signals high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The flaw is reachable via external HTTP GET traffic, requiring no authentication, which means the attack vector is network‑based and readily exploitable. An adversary could extract confidential information and potentially alter database entries, depending on the database user privileges.