The Book Library (Free) extension for Joomla contains an unauthenticated SQL Injection vulnerability in versions up to 6.4.6. The vulnerability exists in the books() function of site/booklibrary.php, which reads 'field' and 'direction' request parameters and attempts to sanitize them using a function called protectInjectionWithoutQuote(). This function relies on a keyword blacklist that only wraps values containing the substring 'select' in a quote function, but the values are concatenated directly into an unquoted ORDER BY clause where quoting is ineffective. Exploitation requires a two-step process involving priming session-stored sort defaults and using a trailing decoy comment '-- xselect' to bypass the blacklist, enabling injection of arbitrary SQL commands.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially leading to unauthorized data access, data manipulation, or other high-impact consequences on the affected Joomla site database. The CVSS 4.0 score of 9.3 reflects the critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable extension or restricting access to the affected functionality to trusted users only. Monitor the vendor's website for updates or patches addressing this vulnerability.