CVE-2026-88855
Received Received - Intake

Authenticated SQL Injection in OrdaSoft Joomla Gallery Extension

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: Joomla! Project

Description
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-21
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-88855
EUVD
EUVD-2026-83766

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ordasoft joomla_gallery to 6.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated SQL injection vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7. The flaw occurs in the saveGallery() function where form data is processed without proper sanitization before being used in SQL queries. An attacker with core.manage permissions can exploit this to inject malicious SQL commands, gaining full read/write access to the database, including extracting user password hashes.

Detection Guidance

This vulnerability requires authenticated access to Joomla with core.manage permissions. Check Joomla extensions for OrdaSoft Joomla Gallery versions below 6.2.7. Review database access logs for suspicious SQL queries or UNION-based extraction attempts from untrusted inputs.

Impact Analysis

If you use the vulnerable Joomla Gallery extension, an attacker with basic authenticated access could steal sensitive data like user credentials, modify or delete database records, or gain unauthorized control over your Joomla site. This could lead to data breaches, website defacement, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and potentially triggering breach notification requirements. For HIPAA, it may compromise protected health information, leading to compliance violations and penalties. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later to patch the SQL injection vulnerability. If immediate updating is not possible, restrict core.manage user permissions to the minimum required and monitor database queries for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart