The vulnerability resides in Joomla J2 JOBS 1.3.0, where an authenticated administrator can supply arbitrary SQL code through the 'sortby' parameter in a POST request to the admin index. By injecting malicious statements, the attacker can alter the database query to read or manipulate data, potentially revealing confidential information. The weakness is a classic input validation failure leading to SQL injection (CWE‑89).

Joomsky’s J2 JOBS component, version 1.3.0, is the only product explicitly identified as affected. No other vendors or versions are listed.

With a CVSS score of 7.1 the severity is medium‑high, and the exploit likelihood is undetermined because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires valid administrator credentials, so the vector is authenticated; once authenticated, an attacker can craft a POST request with a malicious 'sortby' value to retrieve sensitive database information. The exploitation path is straightforward and does not require any additional pre‑conditions beyond administrative access.