The Joomla SP Movie Database 1.3 component is vulnerable to an unsanitized SQL injection that occurs when a user supplies a crafted string in the searchword parameter of the searchresults controller. An attacker can embed arbitrary SQL commands in a GET request, causing the application to execute those statements against the Joomla database. The result is that sensitive data such as user credentials, site configuration, and other protected information can be read or manipulated. The flaw does not directly provide system-level execution but the extracted data can be leveraged for further attacks, elevating the potential impact beyond simple data disclosure.

Any Joomla installation that includes the SP Movie Database extension version 1.3. The vulnerability is limited to that specific version; later releases of the component are presumed to have fixed the issue but must be verified. Administrators should audit whether the component is present and its version on their sites.

The CVSS score of 8.8 classifies this as a high severity flaw. Because the attack requires no authentication and is accessed via a standard HTTP GET request, it is broadly exploitable. No EPSS score is available, but the lack of a KEV listing does not reduce the attack surface. An attacker can construct a single request to extract data, making the threat realistic for targetable Joomla sites that host the vulnerable extension.