CVE-2026-102781
Received Received - Intake

Unauthenticated Destructive CRUD in OrdaSoft Touch Slider Joomla Extension

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Joomla! Project

Description
Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser(), authorise(), or a CSRF token check exists anywhere in the handler. Two confirmed impact paths: an unauthenticated GET deletes any slider image by guessable sequential IDs, and an unauthenticated multipart upload with a zip file renames and replaces the entire #__os_touch_slider/#__os_touch_slider_text tables site-wide with attacker-supplied content, with no task parameter even required for the second path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-102781
EUVD
EUVD-2026-94215

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ordasoft.com Touch Slider extension for Joomla 1.0.0-5.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated destructive vulnerability in the OrdaSoft Touch Slider Joomla extension version before 5.4.6. The flaw exists in the modOsTouchSliderHelper::getAjax() function, which handles all data operations without requiring authentication or CSRF protection. Attackers can exploit this to delete slider images by guessing sequential IDs or replace entire database tables with malicious content via a zip file upload.

Detection Guidance

Check for unauthorized file deletions or modifications in Joomla's #__os_touch_slider and #__os_touch_slider_text directories. Review server logs for suspicious GET requests targeting modOsTouchSliderHelper::getAjax() without authentication. Look for unexpected multipart uploads or zip file processing in Joomla's com_ajax dispatcher.

Impact Analysis

An attacker could delete all slider images on your Joomla site by exploiting the sequential ID deletion path. The multipart upload path allows replacing your slider tables with attacker-controlled content, potentially defacing your site or injecting malicious scripts. Both paths require no authentication or user interaction.

Compliance Impact

This vulnerability could lead to unauthorized data modification or destruction, violating integrity requirements in GDPR and HIPAA. If personal data in sliders is altered or deleted, it may constitute a data breach under these regulations, requiring notification and potential fines.

Mitigation Strategies

Immediately update the OrdaSoft Touch Slider extension to version 5.4.6 or higher. Disable the com_ajax dispatcher if not required. Implement strict file upload restrictions and disable sequential ID-based deletions. Review server logs for signs of exploitation and remove any unauthorized files or database entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102781. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart