An unauthenticated blind SQL injection vulnerability in the Jefferson49 Sexy Polling Reloaded extension for Joomla poses a high risk to database confidentiality.

This is an SQL injection vulnerability (CWE-89) residing within the extension, which permits an unauthenticated remote attacker to execute arbitrary SQL queries against the backend database.

Successful exploitation of this vulnerability allows unauthorized actors to perform blind SQL injection, which can lead to the exfiltration of sensitive information stored within the Joomla database. Given the CVSS score of 8.7, this flaw represents a high-severity risk that could lead to significant data breaches and compromise the integrity of the entire web application environment.

Immediate Action: Administrators should immediately disable or remove the Sexy Polling Reloaded extension until a patch is released by the vendor, as no official fix is currently confirmed.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious query patterns, such as unusual URL parameters containing SQL syntax or high-frequency requests originating from single IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to intercept and block malicious payloads targeting the vulnerable extension endpoints.

Public Exploit Available: No (exploit_available: false)

The severity of this unauthenticated SQL injection requires immediate attention to prevent unauthorized database access. Since a patch is not yet confirmed, the most effective mitigation is the immediate removal of the vulnerable extension to eliminate the attack surface entirely. Regularly audit your Joomla environment for unauthorized extensions and ensure all components are tracked in your vulnerability management lifecycle.