A critical SQL injection vulnerability in the Fabrik extension for Joomla permits unauthenticated attackers to perform unauthorized read operations on the backend database.

This is an SQL injection vulnerability, identified as CWE-89, located in the getFilterQuery function. The application improperly neutralizes special elements in the filter condition parameter, which is then concatenated into the SQL WHERE clause, allowing unauthenticated attackers to manipulate database queries.

The ability to perform arbitrary SQL queries allows an attacker to bypass authentication, exfiltrate sensitive user data, or compromise administrative credentials stored in the database. The high CVSS score of 9.3 underscores the severe risk of data breach and loss of confidentiality associated with this vulnerability.

Immediate Action: Update the Fabrik extension for Joomla to version 4.7.4 or later to remediate the unsafe concatenation of SQL parameters.

Proactive Monitoring: Review database audit logs for anomalous query structures or signs of unauthorized data retrieval attempts.

Compensating Controls: Implement WAF rules designed to filter out SQL injection payloads, such as common tautology or union-based attack signatures.

Public Exploit Available: Unknown

The risk of data compromise is substantial given the unauthenticated nature of this flaw. Organizations should treat this as a high priority item and apply the vendor provided update without delay.