POCBIT
Log inSign up

CVE-2026-88854 — OrdaSoft Joomla Gallery ≤ 6.2.6 Unauthenticated SQL Injection

Unauthenticated SQL injection in OrdaSoft **OS Gallery** (`com_osgallery` / `com_osgallery_light` ≤ 6.2.6) via the image **search** parameter (`textsearch`).

#joomla#sql-injection#unauthenticated#ordasoft

CVE:

CVE-2026-88854

Date:

2026-09-25

Severity:

CRITICAL

Exploit source

PoC code is available to registered members only.

Log inSign up

Description

Overview

CVE-2026-88854 affects OrdaSoft OS Gallery for Joomla (≤ 6.2.6). The image search feature (textsearch and related parameters) is reported to pass unsanitized input to SQL queries, enabling unauthenticated SQL injection.

Impact

SQL injection can expose database contents (users, sessions, configuration), support authentication bypass, and in some configurations assist further compromise of the Joomla site.

Affected components

  • com_osgallery
  • com_osgallery_light

Remediation

Upgrade the gallery extension to a vendor-fixed build. WAF rules are a temporary measure only.

PoC

The Python checker/exploit script targets the search endpoint described in community advisories.

Legal and ethical use

Use bundled tools only on WordPress/Joomla sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.

References

  • Look up the CVE ID on NVD and the CVE Program for official records.
  • Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.