The Joomla extension JoomCCK contains a front‑end controller task that concatenates a user‑supplied request parameter directly into two SQL statements without escaping or parameterisation. This design flaw enables attackers to inject arbitrary SQL code when they send a crafted request to the vulnerable controller. The injection can be performed without authentication, potentially allowing attackers to read, alter, or delete data stored in the Joomla database.

Systems running the joomcoder.com JoomCCK extension for Joomla are affected; specific version information is not available in the CVE payload.

The exploit is straightforward because it requires no credentials; an unauthenticated web request to the exposed controller task will trigger the vulnerability. The EPSS score is < 1% and the CVSS score is 8.7, indicating high severity. The vulnerability is not listed in the CISA KEV catalog, but the potential impact of arbitrary database manipulation suggests a high degree of risk. Attackers could leverage this flaw to gain unauthorized access to sensitive information or compromise the integrity of the Joomla site.