An authenticated SQL injection vulnerability exists in Joomla J2 JOBS 1.3.0 that allows attackers to inject SQL code via the ‘sortby’ parameter. By sending malicious POST requests to the administrator index, a logged‑in attacker can alter database queries and directly read sensitive data. The flaw is a classic instance of CWE‑89: SQL Injection, and its primary consequence is the leakage of confidential information from the database.

The affected product is Joomsky’s J2 JOBS, version 1.3.0. No other products or sub‑versions are listed in the CNA data.

The CVSS score of 7.1 indicates high severity, but the vulnerability requires an authenticated administrator session. With EPSS data unavailable, the probability of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the Joomla backend; once authenticated, they can exploit the injection by crafting POST requests to the administration index. The risk is moderate to high for systems that expose the J2 JOBS backend to untrusted users or have weak access controls.