CVE-2026-101108: Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Ordasoft Vehicle Manager (Free) versions earlier than 6.5.8 are affected. The vulnerable code is reachable through anonymous frontend category-listing, search, and all-vehicles listing entry points.
Does an attacker need an account or special permissions?
No. The affected frontend entry points are anonymously reachable, so exploitation does not require authentication.
Which parameters are involved?
The affected sort parameters are order_field and order_direction. Their values are inserted into an unquoted ORDER BY clause, where the applied escaping does not protect against SQL injection.