The Zoo extension for Joomla version 4.1.64 and earlier contains an unauthenticated SQL injection flaw within the ItemController::element() method. The vulnerability arises because the filter_type request parameter and values supplied in the type_filter array are concatenated directly into a SQL query without any quoting or escaping. This omission lets an attacker inject arbitrary SQL statements into the query. The effect is the ability for a remote attacker to read, modify, or delete data from the Joomla database, and potentially cause further damage if additional application logic is affected.

Zoo extension for Joomla by yootheme.com, versions older than 4.1.64.

The CVSS score of 9.3 reflects a high severity with full attacker's privileges gained via unauthenticated HTTP requests to the affected endpoint. EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. The lack of input sanitization means any crafted request can execute malicious SQL, which may also expose sensitive information such as user credentials or content data. The high CVSS score indicates that even with low prior likelihood, the potential impact is significant.