JoomCRM 1.1.1 contains an SQL injection flaw that allows an authenticated attacker to manipulate the deal_id parameter in a GET request, enabling the execution of arbitrary SQL statements. This can lead to the extraction of sensitive data such as table names, database schemas, and potentially other confidential information. The weakness is a classic input validation failure mapped to CWE-89.

The vulnerability affects the Joomboost JoomCRM component for Joomla, specifically version 1.1.1. The component is deployed within a Joomla! site and relies on the Joomla authentication system to control access to the vulnerable endpoint.

The CVSS base score of 7.1 indicates a high severity with medium impact on confidentiality and integrity, but no availability impact is noted. The EPSS score is not available, suggesting no readily available public exploitation statistics, and the flaw is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated to the Joomla site; an attacker with valid credentials can craft a GET request to index.php?option=com_joomcrm&view=contacts&deal_id=… to inject and execute malicious SQL queries.