Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-100752 EUVD-2026-88434GHSA-rfcm-hchc-h7rw

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

Published Sep 28, 2026 · Updated Sep 30, 2026 · Assigned by Joomla

Vendor: ordasoft.com Product: Real Estate Manager (Free) extension for Joomla Category: Web / CMS

Description

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.

Affected products

VendorProductAffectedFixed
ordasoft.com Real Estate Manager (Free) extension for Joomla 1.0.0-6.7.8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-100752 ★ 0 · Sep 29, 2026

    CVE-2026-100752 PoC: OrdaSoft Joomla Real Estate Manager (Free) <=6.7.8 unauth SQLi via order_field ORDER BY (com_realestatemanager). Colored check + mass exploit, version fingerprint, PoCbit https:/…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References