Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-88854 EUVD-2026-83767GHSA-w2hx-m888-mfj4

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Published Sep 20, 2026 · Updated Sep 22, 2026 · Assigned by Joomla

Vendor: ordasoft.com Product: OrdaSoft Joomla Gallery extension for Joomla Product: OrdaSoft Joomla Gallery free extension for Joomla Category: Web / CMS

Description

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.

Affected products

VendorProductAffectedFixed
OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla 1.0.0-6.2.6 —
OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla 1.0.0-6.2.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-88854 ★ 2 · Sep 20, 2026

    CVE-2026-88854 — OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References