The vulnerability is a classic SQL injection flaw that allows an attacker to inject arbitrary SQL code through the catid parameter in Joomla StreetGuessr Game. When an unauthenticated user sends a GET request that includes this parameter, the application fails to properly sanitize the value, enabling retrieval of sensitive database information such as version numbers and database names. The impact is primarily a breach of confidentiality, allowing attackers to read data from the underlying database without needing prior authentication.

The affected product is the StreetGuessr Game component, version 1.1.8, developed by Nordmograph and used within the Joomla content management system. Only installations that have this specific version of the StreetGuessr component deployed are vulnerable.

The CVSS score of 8.8 classifies this flaw as High severity, with no authentication required and a moderate complexity requirement for exploitation. Although no EPSS score is available and the vulnerability is not listed in CISA KEV, the nature of the flaw – unauthenticated SQL injection – suggests a relatively straightforward exploitation path via crafted URL requests to index.php with option=com_streetguess&view=maps. Attackers can simple supply malicious input in the catid parameter to extract data.