Joomla! Component Flip Wall 8.0 contains a flaw where the wallid parameter is concatenated directly into an SQL query without proper sanitization. By crafting a GET request to index.php with option=com_flipwall, task=click, and a malicious wallid value, an attacker can execute arbitrary SQL queries. This enables extraction of sensitive database content and could serve as a foothold for further compromise, impacting confidentiality and potentially integrity of the application database. The vulnerability is a classic SQL injection (CWE-89).

The affected product is Pulseextensions Flip Wall component used within Joomla CMS. The current public information specifies the vulnerable component version as 8.0; no additional sub‑release or build details are provided. Only unauthenticated access to the component's click task exposes the flaw.

The CVSS score of 7.1 indicates high severity, reflecting the unauthenticated remote exploitation and data impact. EPSS is not available, and the issue is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. Nevertheless, the external validation from exploit-db and vulncheck confirms that an attacker can trigger the injection by sending a simple HTTP GET request; therefore the attack vector is accessible from the public internet without additional authentication or privileged access.