Joomla version 2.5.28 with JomEstate component version 4.1 suffers from a remote SQL injection vulnerability.