Joomla! Component EkRishta 2.10 contains an error‑based SQL injection flaw that permits an attacker to inject malicious code into the username parameter of the login POST endpoint. The vulnerability allows an unauthenticated user to execute arbitrary SQL statements, which can be used to read database contents, including user credentials and system configuration. The weakness is a classic input validation issue identified as CWE‑89, with potential impacts on confidentiality and integrity of the site data.

All installations of the EkRishta extension version 2.10 for Joomla, distributed by Harmistechnology, are affected. No other versions or related components are listed as vulnerable.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. The likely attack vector is unauthenticated via the public login endpoint; an attacker can send a crafted POST request with a SQL payload in the username field to extract database information. Exploitation requires no special privileges beyond access to the login page, making it relatively straightforward for remote attackers.