The Vehicle Manager (Free) extension for Joomla, versions 1.0.0 up to 6.5.7, contains an unauthenticated SQL Injection vulnerability (CWE-89). The vulnerability arises from the handling of the order_field and order_direction parameters in the site/vehiclemanager.php script at three anonymous frontend entry points (category listing, search, and all-vehicles listing). Although a sanitizing function applies real escaping, the parameters are inserted into an unquoted ORDER BY clause, rendering the escaping ineffective and allowing SQL injection.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to data disclosure, data modification, or other impacts depending on the database privileges. The CVSS 4.0 base score is 9.3 (critical), indicating high impact with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the vulnerable frontend entry points or applying web application firewall rules to block malicious input targeting the order_field and order_direction parameters.