The Phoca Cart extension for Joomla versions 5.0.0 to 6.1.16 contains an unauthenticated SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, the a[] and s[] GET array parameters on the public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping, enabling attackers to inject arbitrary SQL. This vulnerability allows full database extraction through time-based blind SQL injection methods. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability remotely to execute arbitrary SQL commands on the backend database. This can lead to full extraction of the database contents, compromising confidentiality, integrity, and availability of the data managed by the Phoca Cart extension. The vulnerability does not require any authentication or user interaction, making it highly exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restricting access to the affected parameters or disabling the vulnerable functionality may reduce risk, but no vendor-endorsed mitigation is currently provided.