Authenticated Remote Code Execution in OrdaSoft Joomla Gallery Extension

Executive Summary

This is an authenticated, privileged remote code execution vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7. The flaw exists in the saveWatermark() function, which allows an authenticated user with core.manage privileges to upload a malicious PHP file disguised as an image. The file is saved with the exact client-supplied filename without any checks for extensions, content, or sanitization. This enables the attacker to execute arbitrary code by directly accessing the uploaded file.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in web-accessible directories, particularly in Joomla Gallery extension folders. Look for files with image Content-Type headers but .php extensions. Review server logs for suspicious uploads or requests to paths matching uploaded filenames.

Useful 0 Not Useful 0

Impact Analysis

If you are using the vulnerable OrdaSoft Joomla Gallery extension (version < 6.2.7), an attacker with authenticated access could exploit this to execute arbitrary code on your server. This could lead to full system compromise, data theft, or unauthorized modifications. The attacker needs at least core.manage privileges in Joomla to exploit this.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or data exfiltration, which would violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations may face legal penalties, reputational damage, and loss of customer trust if such a breach occurs due to this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later. Remove any unauthorized PHP files from web directories. Restrict file upload permissions to prevent arbitrary file execution. Monitor for suspicious activity in Joomla admin logs.

Useful 0 Not Useful 0