CVE-2026-88855: Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from categorynames[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #users password hashes.
Affected Software
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker must be authenticated and have the Joomla core.manage permission for the affected gallery component. This permission can be scoped to managing that component and does not require administrator-wide privileges.
What data and systems could be affected if exploitation succeeds?
The injection provides full read/write access to the Joomla database. An attacker could use UNION-based queries to extract data such as #__users password hashes and could modify database contents.
Which installations are affected?
Installations using the OrdaSoft Joomla Gallery extension for Joomla versions earlier than 6.2.7 are affected according to the available information.