CVE-2026-88855
HighCVSS 8.6Summary
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged SQL injection vulnerability was found. The saveGallery() function passes form data through a hand-rolled parser into Joomla's Input object, then reads it back with ARRAY/STRING filter types, neither of which sanitizes SQL content. Values from category_names[], catOrderIds, and image-ordering fields are concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database, including UNION-based extraction of #__users password hashes.
Risk Assessment
An authenticated user with core.manage permissions can read and modify the entire database, including user password hashes, leading to complete system compromise.
Recommendation
Immediately update the extension to version 6.2.7 or later. Additionally, restrict core.manage permissions and conduct regular security audits.
Other vulnerabilities in OrdaSoft Joomla Gallery
See all- CVE-2026-88857Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
- CVE-2026-88856Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.
- CVE-2026-88854Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an unauthenticated SQL injection vulnerability was found. The showSearchResult() and showSearchResultAjax() functions read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and only strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login, and the search module is public.
Original NVD description (English source)
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.