An unauthenticated SQL injection vulnerability in the Phoca Cart extension for Joomla poses a critical risk by allowing remote attackers to extract sensitive database information.

This vulnerability is an SQL injection flaw occurring in the attribute and specification filter parameters of the public shop items page. The application fails to sanitize or parameterize input, allowing an unauthenticated attacker to execute arbitrary SQL commands.

The ability to perform time-based blind SQL injection allows an attacker to exfiltrate the entire contents of the database, which may include customer data, order history, and administrative credentials. Given the CVSS score of 9.3, this represents a critical risk to data confidentiality and integrity, potentially leading to severe regulatory non-compliance and reputational damage.

Immediate Action: Update the Phoca Cart extension for Joomla to the latest available version provided by the vendor.

Proactive Monitoring: Monitor database query logs for unusual time-based patterns or syntax errors that indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in GET parameters.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability is critical because it allows full database access without requiring any user privileges. Administrators must prioritize updating the Phoca Cart extension immediately to prevent unauthorized data exfiltration.