Unauthenticated SQL injection is present in the Fabrik extension for Joomla when the order parameter in list models is used without validation. Attackers can supply arbitrary ORDER BY clauses to the database, enabling read‑only data extraction, including credentials or sensitive content. The underlying weakness is a classic SQL injection flaw (CWE‑89) that allows unauthenticated users to read data from the database through crafted web requests.

Fabrik extension for Joomla, supplied by fabrikar.com, is affected in versions earlier than 4.7.3. Joomla sites deploying any Fabrik build below 4.7.3 expose this vulnerability and must update to the latest release to receive the patch that validates the order parameter.

The vulnerability carries a CVSS score of 9.3, indicating critical impact. EPSS is unavailable, but the lack of authentication requirement and remote exploitation via standard web requests mean the risk is high. Since the vulnerability is not listed in CISA's KEV catalog, no known exploits are recorded yet, but the attack vector is plausible for any publicly accessible Joomla site using the vulnerable Fabrik extension.