The Joomla! Component vBizz 1.0.7 is vulnerable to SQL injection, allowing authenticated attackers to inject malicious code into the payid parameter via POST requests to the employee management interface. This flaw enables execution of arbitrary SQL queries against the underlying database, potentially revealing sensitive information such as database names, versions, and data stored within. Because the injection is not limited to read-only operations, attackers may also modify or delete data, leading to data integrity and confidentiality compromise.

The affected product is the vBizz component for Joomla, version 1.0.7, distributed by Wdmtech. Joomla sites running this component and allowing authenticated users to access the employee management interface are at risk.

The CVSS score of 7.1 indicates high severity, reflecting the potential impact of data compromise. No EPSS score is available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the web interface, and requires that the attacker be authenticated and have access to the employee management page.