The Price Alert component for Joomla! 3.0.2 contains an SQL injection flaw that allows an unauthenticated attacker to inject arbitrary SQL statements through the product_id parameter used in the subscribeajax view. This vulnerability can be exploited by sending crafted HTTP requests that return sensitive database contents, including user credentials and configuration details, potentially leading to a full compromise of the Joomla site’s data store.

Systems using the Joomla! Component Price Alert version 3.0.2 provided by Weborange are affected. The component may be present on any Joomla installation that has integrated this extension, and older versions of the component are believed to be susceptible as well.

The flaw scores 8.8 on CVSS, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is likely remote and unauthenticated, requiring the attacker to send an HTTP request to the subscribeajax endpoint with a malicious product_id payload. An attacker does not need to authenticate or possess elevated privileges to exploit this flaw, making it readily accessible from the public internet.