An unauthenticated SQL injection exists in the booklibrary.php script of the Book Library (Free) extension for Joomla. The vulnerability arises from the books() function reading the 'field' and 'direction' request parameters, passing them through a function called protectInjectionWithoutQuote() that only performs a keyword blacklist check and then directly concatenates the result into an unquoted ORDER BY clause. Because quoting is applied to the value only when the blacklist detects the substring 'select', the injected payload can bypass the check by including a trailing comment, such as '-- xselect', and will be executed by the database. This flaw enables an attacker to inject arbitrary SQL, potentially allowing data exfiltration or modification.

The only vendor/product pair affected is ordasoft.com’s Book Library (Free) extension for Joomla. Versions lower than 6.4.6 are vulnerable; any installation of the extension prior to the release of 6.4.6 is susceptible.

The CVSS v3.1 score of 9.3 underscores the severity of this flaw. The EPSS score is unavailable, so no current exploitation probability is provided, and the vulnerability has not been listed in the CISA KEV catalog. Attackers would need to forge an unauthenticated HTTP request to the vulnerable endpoint, first priming session defaults and then appending a decoy comment to trigger the blacklist. Given the lack of authentication checks and the direct injection into SQL, the likelihood of exploitation in the wild is substantial, especially for sites that have not applied the latest extension update.