CVE-2026-100752
Received Received - Intake

Unauthenticated SQL Injection in Joomla Real Estate Manager

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Joomla! Project

Description
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-100752
EUVD
EUVD-2026-88434

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ordasoft real_estate_manager to 6.7.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in the Joomla Real Estate Manager extension (Free) versions before 6.7.9. The flaw exists in the site/realestatemanager.php file where the ORDER BY clause of property-listing queries is built using a user-controlled order_field parameter. This parameter is directly concatenated into an unquoted SQL clause without validation, allowing attackers to inject malicious SQL commands.

Detection Guidance

To detect this vulnerability, monitor for unusual SQL queries or errors in your Joomla system logs, particularly from the Real Estate Manager extension. Check for requests to site/realestatemanager.php with order_field parameters containing SQL syntax or unexpected values. Use network monitoring tools to inspect traffic for suspicious database interactions.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access, modification, or deletion. This includes stealing sensitive user data, defacing the website, or taking full control of the Joomla site. Since no authentication is required, any visitor could potentially exploit this vulnerability.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR and HIPAA requirements for data protection. Organizations using this extension may face compliance violations, legal penalties, and reputational damage due to potential data breaches resulting from the SQL injection flaw.

Mitigation Strategies

Immediately update the Real Estate Manager extension to version 6.7.9 or later to patch the SQL injection vulnerability. Disable the extension if an update is not immediately available. Monitor network traffic for suspicious SQL queries targeting the realestatemanager.php file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100752. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart