The Joomla KissGallery component contains a critical SQL injection vulnerability that permits unauthenticated attackers to exfiltrate sensitive data from the underlying database.

This is a SQL injection vulnerability within the KissGallery component, which lacks proper input sanitization. Unauthenticated remote attackers can inject malicious SQL commands via the URL path to interact directly with the database.

The vulnerability carries a CVSS score of 8.2, indicating a high risk of unauthorized data access and potential database compromise. Successful exploitation could lead to the exposure of sensitive user or system information, resulting in significant reputational damage and potential regulatory non-compliance.

Immediate Action: Given the lack of a specific patch version, administrators should disable or uninstall the KissGallery component until a secure update is provided by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous URL patterns containing SQL syntax or suspicious characters indicative of injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting the application's URL parameters.

Public Exploit Available: False

Due to the severity of this unauthenticated SQL injection flaw, immediate action is required to secure the environment. Organizations currently utilizing the KissGallery component should prioritize removing the vulnerable code until a vendor-supplied patch is verified and applied.