CVE-2026-74251 is a critical SQL injection vulnerability in the Phoca Cart extension for Joomla, affecting versions 5.0.0 through 6.1.16. The issue occurs because the a[] and s[] GET array parameters on the public shop items page are concatenated raw into SQL WHERE clauses without any parameterization or escaping. This improper neutralization of special elements (CWE-89) enables unauthenticated attackers to inject arbitrary SQL commands, potentially leading to full database extraction using time-based blind SQL injection techniques. The vulnerability has a CVSS 4.0 score of 9.3, indicating high exploitability and impact, with no privileges or user interaction required.

An unauthenticated attacker can exploit this vulnerability to perform arbitrary SQL injection attacks on the Phoca Cart database. This can lead to full database extraction, compromising the confidentiality and integrity of the data stored within the Joomla installation using the vulnerable extension. The vulnerability does not require authentication or user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Until a patch is available, it is recommended to restrict access to the affected endpoints if possible or apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the a[] and s[] GET parameters.