CVE-2026-100752: Joomla Real Estate Manager SQLi Vulnerability

CVE-2026-100752 Overview

CVE-2026-100752 is an unauthenticated SQL injection vulnerability in the OrdaSoft Real Estate Manager (Free) extension for Joomla, affecting versions prior to 6.7.9. The flaw resides in site/realestatemanager.php, where the ORDER BY clause of three frontend property-listing queries is built from the request-controlled order_field parameter. The parameter is concatenated directly into an unquoted SQL clause without an allow-list of column names and without casting. Attackers can reach the injection point through the category browsing, search results, and full property listing endpoints. No authentication or user interaction is required.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the order_field parameter, exposing the entire Joomla database including administrator credentials and session data.

Affected Products

OrdaSoft Real Estate Manager (Free) for Joomla, versions prior to 6.7.9
Joomla sites exposing the site/realestatemanager.php frontend endpoints
Deployments using category browsing, search results, or full property listing views

Discovery Timeline

2026-09-28 - CVE-2026-100752 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100752

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the sort-order handling logic of the Real Estate Manager extension. Three separate frontend queries (category browsing, search results, and full property listing) read the order_field HTTP parameter and place its value directly into the ORDER BY clause. Because the value is not quoted, not cast, and not validated against a known list of column names, an attacker can append arbitrary SQL syntax. ORDER BY injection is particularly potent because it accepts subqueries and conditional expressions, enabling boolean-based and time-based blind extraction of database contents.

Root Cause

The root cause is unsafe string concatenation of untrusted input into a dynamic SQL statement. The extension trusts the client-supplied order_field value and assumes it names a valid column. Standard parameterization does not apply to ORDER BY identifiers, so the correct pattern is an allow-list mapping request values to known-safe column names. That control is absent in vulnerable versions, and the query is executed as-is against the Joomla database.

Attack Vector

An unauthenticated remote attacker crafts an HTTP request to a public Real Estate Manager listing endpoint and sets order_field to a payload that closes the intended identifier and appends SQL logic. Because three separate code paths are affected, blocking one URL does not eliminate exposure. Successful exploitation allows extraction of arbitrary tables via blind techniques, including the Joomla #__users table, which contains bcrypt password hashes and session tokens. Depending on database privileges, an attacker may also stage secondary payloads such as writing to disk through INTO OUTFILE.

No verified proof-of-concept code is published for this CVE. See the OrdaSoft website for vendor information about affected releases.

Detection Methods for CVE-2026-100752

Indicators of Compromise

HTTP requests to Real Estate Manager listing URLs containing order_field= values with SQL keywords such as SELECT, SLEEP, BENCHMARK, CASE WHEN, or UNION.
Web server access logs showing unusually long response times on property listing endpoints, consistent with time-based blind SQL injection.
Database error entries referencing malformed ORDER BY clauses originating from realestatemanager.php.
Newly created or modified Joomla administrator accounts following anomalous listing-page traffic.

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that inspect the order_field parameter for SQL metacharacters and function names.
Correlate access logs with database query logs to flag ORDER BY clauses that contain subqueries or conditional expressions.
Baseline normal response times for /index.php?option=com_realestatemanager requests and alert on statistically significant deviations.

Monitoring Recommendations

Enable Joomla and MySQL query logging on hosts running the Real Estate Manager extension until patching is complete.
Monitor outbound connections from the web server for unexpected egress that may indicate data exfiltration.
Track authentication events on the Joomla administrator interface for logins from new geolocations or clients following suspicious frontend traffic.

How to Mitigate CVE-2026-100752

Immediate Actions Required

Upgrade OrdaSoft Real Estate Manager (Free) to version 6.7.9 or later on all Joomla installations.
Rotate Joomla administrator passwords and invalidate active sessions if the extension has been internet-exposed.
Audit the #__users table and recent database query logs for signs of data extraction.
Restrict database account privileges used by Joomla to the minimum required, removing FILE and unnecessary write permissions.

Patch Information

OrdaSoft addresses the issue in Real Estate Manager (Free) version 6.7.9. Administrators should obtain the fixed release from the OrdaSoft website and verify the installed version through the Joomla Extensions Manager after upgrade.

Workarounds

Block or filter requests containing the order_field parameter at the WAF or reverse proxy until the patch is applied.
Temporarily disable the Real Estate Manager frontend component in the Joomla administrator console if upgrade is not immediately possible.
Restrict access to Real Estate Manager listing URLs by IP allow-list where public exposure is not required.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in order_field
SecRule ARGS:order_field "@rx (?i)(select|union|sleep|benchmark|case\s+when|--|/\*)" \
    "id:1002026100752,phase:2,deny,status:403,\
     msg:'CVE-2026-100752 Real Estate Manager order_field SQLi attempt'"