CVE-2026-100752: Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled orderfield parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Ordasoft Real Estate Manager (Free) installations with versions earlier than 6.7.9 are affected. The affected code is in the frontend property-listing functionality.
Does exploitation require an authenticated Joomla user?
No. The issue is unauthenticated, and the attacker-controlled order_field request parameter reaches the affected query construction.
Which application functions use the vulnerable query pattern?
The affected ORDER BY construction is used by category browsing, search-result listings, and the full property listing. Each builds its ordering from the request-controlled order_field value.
How can I determine whether an installation is affected?
Check whether the Free edition is below version 6.7.9. Code review can also identify the condition: site/realestatemanager.php concatenates order_field directly into an unquoted ORDER BY clause without an allow-list or type cast.