CVE-2026-101110: Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(), whose only real protection is a keyword blacklist that, on detecting the literal substring select, wraps the value in $db->quote() instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two conditions: a first request to prime session-stored sort defaults, and a trailing decoy comment (-- xselect) that satisfies the blacklist’s substring check without altering the payload’s effect.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can reach the vulnerable code without authentication, but exploitation requires first sending a request that primes session-stored sorting defaults. The injection payload must also include a trailing decoy comment containing the literal substring "select", such as "-- xselect", to trigger the ineffective blacklist behavior.
Which installations are affected?
The issue affects the Free edition of Ordasoft Book Library versions earlier than 6.4.6. The vulnerable path is in site/booklibrary.php in the books() function.
Why does the filter not stop the SQL injection?
The field and direction parameters are concatenated into an unquoted ORDER BY clause. When the blacklist detects the substring "select", it quotes the input rather than rejecting it, but quoting does not protect a value used in that SQL clause position.