CVE-2026-88854 — OrdaSoft Joomla Gallery ≤ 6.2.6 Unauthenticated SQL Injection
September 25, 2026 · 376 views
Unauthenticated SQL injection in OrdaSoft **OS Gallery** (`com_osgallery` / `com_osgallery_light` ≤ 6.2.6) via the image **search** parameter (`textsearch`).
Description
Overview
CVE-2026-88854 affects OrdaSoft OS Gallery for Joomla (≤ 6.2.6). The image search feature (textsearch and related parameters) is reported to pass unsanitized input to SQL queries, enabling unauthenticated SQL injection.
Impact
SQL injection can expose database contents (users, sessions, configuration), support authentication bypass, and in some configurations assist further compromise of the Joomla site.
Affected components
com_osgallerycom_osgallery_light
Remediation
Upgrade the gallery extension to a vendor-fixed build. WAF rules are a temporary measure only.
PoC
The Python checker/exploit script targets the search endpoint described in community advisories.
Legal and ethical use
Use bundled tools only on WordPress/Joomla sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.
Related PoCs
Same platform, vendor, or tags — explore more write-ups on Pocbit.
- JoomlaCVE-2026-101108critical
CVE-2026-101108 — OrdaSoft Joomla Vehicle Manager (Free) Unauthenticated SQL Injection
OrdaSoft Vehicle Manager (Free) for Joomla ≤ 6.5.7: unauthenticated SQL injection (CWE-89) via order_field and order_direction concatenated into unquoted ORDER BY in site/vehiclemanager.php (com_vehiclemanager). Escaping is ineffective for sort keys. Public category, search, and all-vehicles views. Fixed in 6.5.8+. CVSS 4.0 9.3 Critical. Python PoC: check, error-based exploit, mass -j.
- JoomlaCVE-2026-101110critical
CVE-2026-101110 — OrdaSoft Joomla Book Library (Free) Unauthenticated SQL Injection
OrdaSoft Book Library (Free) for Joomla ≤ 6.4.6: unauthenticated SQL injection (CWE-89) in books() via field/direction sort params — weak select substring blacklist + protectInjectionWithoutQuote, unquoted ORDER BY, session prime + `-- xselect` bypass (com_booklibrary). Fixed in 6.4.7+. CVSS 4.0 9.3 Critical. Python PoC: check, exploit, mass -j.
- JoomlaCVE-2026-102428critical
CVE-2026-102428 — OrdaSoft Joomla CCK (com_os_cck) Unauthenticated ORDER BY SQLi
OrdaSoft OS CCK com_os_cck 1.0.0–8.3.15: public listing sort order_field/order_direction appended to SQL ORDER BY without column allow-list (CWE-89). Unauth error-based extract, check + mass exploit. CVSS 4.0 9.3 Critical. Fixed 8.3.16+ (same as CVE-2026-102427). Marker POCBIT-102428-OK.
- JoomlaCVE-2026-100752high
CVE-2026-100752 — OrdaSoft Joomla Real Estate Manager (Free) Unauthenticated SQL Injection
OrdaSoft Real Estate Manager (Free) for Joomla ≤ 6.7.8: unauthenticated SQL injection (CWE-89) via order_field concatenated into ORDER BY in site/realestatemanager.php (com_realestatemanager). Public category, search, and listing views — no auth. Fixed in 6.7.9+. Python PoC: fingerprint, check, error-based exploit, mass -j; legacy order_direction POST fallback.