The component exposes a raw SQL query executed via the cid parameter, allowing attackers to inject arbitrary SQL. An unauthenticated attacker can send crafted GET requests to index.php with option=com_ajaxquiz and view=ajaxquiz, bypassing authentication entirely. The result is full read access to the site's database, exposing table names, column structures and potentially personal data. This injection vulnerability falls under CWE-89 and poses a severe confidentiality risk.

Webkul's Ajax Quiz component for Joomla, version 1.8, is affected. The vulnerability exists in the published release of the component and impacts any Joomla site that has installed Ajax Quiz 1.8 without the patch.

With a CVSS score of 8.8 the vulnerability is rated as high severity. The EPSS metric is unavailable, and it is not listed in the CISA KEV catalog, but its impact remains significant. Attackers need only craft a GET request to the vulnerable endpoint, with no authentication required, making the exploit straightforward and likely to be automated. The lack of a KEV listing does not reduce the risk to sites that host the component.