CVE-2026-88854: Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: modosgallerysearch is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any anonymous visitor can exploit it if the mod_osgallery_search search box is publicly published. No login or other authentication is required.
What does an attacker need to send?
An attacker needs to supply SQL syntax in the textsearch or searchText request parameter handled by showSearchResult() or showSearchResultAjax(). Because the value is inserted directly into a LIKE clause without escaping, a UNION SELECT can be used to read arbitrary database content.
Which versions are affected?
The issue affects OrdaSoft Joomla Gallery extension versions earlier than 6.2.7.