An unauthenticated remote code execution vulnerability in the Fabrik extension for Joomla allows attackers to gain full system control via the ajax_calc plugin functionality.

This is a code injection vulnerability (CWE-94) that allows an unauthenticated attacker to execute arbitrary code on the host server. The flaw resides in the ajax_calc feature, which fails to sanitize input, enabling attackers to inject and run malicious commands directly.

With a CVSS score of 10.0, this vulnerability is critical and allows for complete system takeover. Consequences include total data exfiltration, unauthorized administrative access to the Joomla site, and the potential for the server to be used as a pivot point for further attacks on the internal network.

Immediate Action: Disable or remove the Fabrik extension if an immediate update is not available, as this vulnerability is highly exploitable by unauthenticated remote actors.

Proactive Monitoring: Review web server logs for suspicious requests directed at the ajax_calc plugin or unexpected command execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block malicious payloads targeting Joomla extensions and specifically the ajax_calc parameter.

Public Exploit Available: Unknown

Given the maximum CVSS severity and the ease of exploitation for unauthenticated attackers, immediate remediation is required. If a patch is not available from the vendor, the affected plugin must be disabled or removed from the production environment to prevent total system compromise.