Joomla! paGO Commerce component 2.5.9.0 suffers from an authenticated remote SQL injection vulnerability.