rootpwn

high · CVSS v3 7.2 · CVSS v4 8.6

CVE-2026-88855

The OrdaSoft Joomla Gallery extension (v<6.2.7) contains an authenticated, privileged SQL injection that allows a core.manage user to read a

Overview

The OrdaSoft Joomla Gallery extension (v<6.2.7) contains an authenticated, privileged SQL injection that allows a core.manage user to read and write the database, including extracting user password hashes. This flaw arises from unsanitized form data being concatenated into SQL queries. It enables attackers with gallery‑management rights to compromise the entire site’s data integrity and confidentiality.

Description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.

Impact

Confidentiality is breached as attackers can retrieve user credentials and sensitive data. Integrity is compromised because the attacker can modify or delete database records. Availability is not directly affected, but the loss of data integrity can lead to service disruption. The primary impact is on site administrators and users whose accounts may be exposed.

Remediation

Apply the latest patch (v6.2.7 or newer) for the OrdaSoft Joomla Gallery extension. If an update is not immediately possible, restrict the core.manage role to only trusted users, disable the gallery extension, and implement input validation or parameterized queries in the extension code. Monitor database logs for anomalous queries and enforce least‑privilege access controls.

Risk context

The vulnerability is rated high severity with CVSS v3 score 7.2 and CVSS v4 score 8.6, indicating a significant risk. Immediate remediation is recommended to prevent potential credential theft and data tampering.

Affected products

  • OrdaSoft Joomla Gallery
  • Joomla CMS

Scores

Severity
high
CVSS v2
6.5
CVSS v3
7.2
CVSS v4
8.6
EPSS
—

SQL Injection Joomla OrdaSoft Privilege Escalation Database High Severity

← All CVEs

Related CVEs

high

CVE-2026-94110

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.

View analysis

high

CVE-2026-93974

CVE-2026-93974 details a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The vulnerability exists within the `/reviewer_0/admins/assessments/databank/btn_functions.php` file, specifically affecting the `ID` argument. Publicly available exploit code increases the risk of remote compromise.

View analysis

high

CVE-2026-94090

JusticeRage Manalyze 1.0.0 contains a remote integer underflow in the PE::_parse_debug function that can corrupt memory or crash the parser. The flaw allows attackers to manipulate the misc.Length argument, potentially leading to denial of service or unintended data exposure. Prompt patching is essential to mitigate these risks.

View analysis

high

CVE-2026-94093

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

View analysis