rootpwn

critical · CVSS v3 9.8 · CVSS v4 9.3

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to exe

Overview

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

Description

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.

Impact

Confidentiality: attackers can read arbitrary database tables, including user credentials and site content. Integrity: potential for data manipulation if the injection is extended. Availability: not directly impacted. Defenders: site administrators and security teams must address the issue promptly.

Remediation

Update to the latest version of the OrdaSoft Joomla Gallery extension that includes proper input sanitization. If an update is not possible, disable the mod_osgallery_search endpoint or restrict it via a web application firewall to block SQL injection patterns. Ensure the Joomla core is up to date and monitor for any anomalous database activity.

Risk context

The vulnerability carries a critical severity (CVSS 9.8) and requires no authentication, making it an immediate threat to any site running the affected extension. Prompt remediation is recommended to prevent data exfiltration.

Affected products

  • OrdaSoft Joomla Gallery
  • Joomla CMS
  • OrdaSoft.com

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
9.3
EPSS
—

sql-injection unauthenticated Joomla OrdaSoft critical web-application database-exfiltration

← All CVEs

Related CVEs

critical

CVE-2026-94095

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94096

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94097

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94101

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis