CVE-2026-88855
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.
| CWE | CWE-89 |
| Vendor | ordasoft.com |
| Product | ordasoft joomla gallery free extension for joomla |
| Published | Sep 20, 2026 |
| Last Updated | Sep 20, 2026 |
Get instant alerts for ordasoft.com ordasoft joomla gallery free extension for joomla
Be the first to know when new unknown vulnerabilities affecting ordasoft.com ordasoft joomla gallery free extension for joomla are published — delivered to Slack, Telegram or Discord.