Joomla PhocaDownload component version 3.1.7 suffers from database disclosure and remote SQL injection vulnerabilities.