Joomla! Component Twitch Tv 1.1 is vulnerable to SQL injection that allows attackers to run arbitrary SQL statements by injecting code into the username and id parameters of the component. The flaw can be exploited by unauthenticated users via crafted GET requests to index.php, enabling the extraction of sensitive database contents such as credentials and system configuration data, thereby compromising confidentiality and potentially aiding further attacks.

The vulnerability limits to the Raindropsinfotech Twitch Tv component, version 1.1. No other Joomla! components or versions are affected as per the vendor information.

The CVSS score of 8.8 indicates a high severity level, and the lack of an EPSS score suggests no current exploitation data is available. The component is not listed in CISA KEV. Attackers can trigger the flaw through normal HTTP GET traffic to the component without requiring authentication, so the attack vector is readily reachable over the web.