The vulnerability arises from improper validation of order clauses within the com_tags component of Joomla CMS, allowing an authenticated attacker to craft malicious SQL statements. This flaw can be used to extract sensitive data from the underlying database, potentially exposing confidential content, user credentials, or configuration information. The weakness is classified as a blind SQL injection, which typically requires the attacker to rely on time-based or error-based techniques to infer data, but still poses a significant risk to integrity and confidentiality.

The affected product is Joomla! CMS, specifically the com_tags component. No specific product version is listed in the available data, so any installation of com_tags that has not been updated to the latest security release should be considered vulnerable.

The vulnerability is rated with a CVSS score of 6.9, indicating moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting no publicly known exploitation yet. The attack vector requires authentication, meaning that an attacker must first gain access to a Joomla user account. Once authenticated, the attacker can supply a crafted order clause to the component’s query interface and, through blind techniques, retrieve data from the database. Given the lack of public exploitation evidence, the risk of exploitation is moderate but cannot be ignored if the site hosts sensitive data.