The Gridbox extension for Joomla contains an unauthenticated SQL injection flaw in the handling of the sort‑by URL parameter on product list pages. The parameter value is filtered with a generic string filter and then incorporated directly into an ORDER BY clause without proper validation. This allows an attacker to inject arbitrary SQL into the query, which can be used to read, modify, or delete data from the underlying databases. The flaw is classified as CWE‑89 and can potentially lead to complete data compromise or system compromise if the database contains sensitive information.

The vulnerability affects the balbooa.com Gridbox extension for Joomla versions earlier than 2.20.4.2. Only these releases are impacted; newer versions have fixed the input validation logic. Administrators using these versions must immediately verify if the extension is present and running on their websites.

The impact rating is high with a CVSS score of 9.3. Exploitation requires only the ability to construct a URL that reaches the Gridbox component, and no authentication is necessary. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication combined with the severity suggests a moderate to high likelihood of exploit in the wild. Acting promptly is recommended to mitigate potential data loss or unauthorized database manipulation.