The Joomla! Component vBizz 1.0.7 is vulnerable to SQL injection, allowing authenticated attackers to inject malicious code into the payid parameter via POST requests to the employee management interface. This flaw enables execution of arbitrary SQL queries that can reveal sensitive information such as database names, versions, and other stored data. Because the injection can read data from the database, attackers could learn information that compromises confidentiality.

The affected product is the vBizz component for Joomla, version 1.0.7, distributed by Wdmtech. Joomla sites running this component and allowing authenticated users to access the employee management interface are at risk.

The CVSS score of 7.1 indicates high severity, reflecting the potential impact of data compromise. No EPSS score is available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the web interface, and requires that the attacker be authenticated and have access to the employee management page.