A vulnerable parameter is concatenated directly into a SQL WHERE clause without sanitization, allowing an attacker to insert arbitrary SQL. The flaw enables read‑only extraction of any database tables reachable by the web application, potentially exposing user credentials, order information, or other sensitive data. The weakness maps to CWE‑89: Improper Neutralization of Special Elements used in an SQL Command.

Any Joomla site that has installed the Fabrik extension before version 4.7.3 is affected. The issue arises when the list filter feature is enabled, which is common in content and form modules provided by Fabrik.

The CVSS score of 9.3 classifies this as critical severity. While no EPSS data is available, the lack of authentication in the attack path increases its likelihood. The vulnerability is not listed in CISA KEV yet, but the potential to harvest large data volumes in a single request poses a high confidentiality risk. Attackers can trigger the injection via normal HTTP requests to the list filter endpoint with a crafted filter condition, bypassing any login requirement.