The Joomla extension DJ-Classifieds allows an attacker to inject arbitrary SQL through its public search interface without authentication. This unauthenticated SQL injection can enable the execution of arbitrary queries on the database, potentially exposing sensitive data or modifying records, and may ultimately lead to full compromise of the site. The flaw falls under CWE-89, a classic SQL injection vulnerability.

All installations of the DJ-Classifieds extension for Joomla with versions earlier than 3.11.3 are affected. The vulnerability is present in the frontend search functionality and does not require any special permissions to exploit.

The CVSS score of 9.3 classifies the vulnerability as Critical, reflecting its remote exploitation potential and lack of authentication requirement. Although no EPSS score is available, the absence of CISA KEV listing does not diminish the urgency; attackers can target any publicly exposed site running a vulnerable version, injecting malicious payloads into the search box to read or modify the database. The high severity and the fact that the exploit can be performed from the internet make this a priority risk.