Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-101108 EUVD-2026-88432GHSA-5695-wvhx-jxj8

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

Published Sep 28, 2026 · Updated Sep 30, 2026 · Assigned by Joomla

Vendor: ordasoft.com Product: Vehicle Manager (Free) extension for Joomla Category: Web / CMS

Description

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.

Affected products

VendorProductAffectedFixed
ordasoft.com Vehicle Manager (Free) extension for Joomla 1.0.0-6.5.7 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-101108 ★ 0 · Sep 29, 2026

    CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://p…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References