CVE-2026-101110: Joomla Book Library SQL Injection Flaw

CVE-2026-101110 Overview

CVE-2026-101110 is an unauthenticated SQL injection vulnerability in the OrdaSoft Book Library (Free) extension for Joomla, affecting versions prior to 6.4.6. The flaw resides in the books() function of site/booklibrary.php, which reads user-controlled field and direction request parameters and passes them through a weak sanitizer named protectInjectionWithoutQuote(). The sanitizer relies on a keyword blacklist rather than parameterized queries, allowing attackers to inject SQL through an unquoted ORDER BY clause. Remote attackers can extract database contents without authentication.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the Joomla database, exposing credentials, session data, and site content [CWE-89].

Affected Products

OrdaSoft Book Library (Free) Joomla extension versions prior to 6.4.6
Joomla installations hosting the vulnerable site/booklibrary.php component
Any site exposing the Book Library books() listing endpoint to unauthenticated users

Discovery Timeline

2026-09-28 - CVE-2026-101110 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101110

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the Book Library extension's book listing controller. The books() function in site/booklibrary.php accepts two request parameters, field and direction, which control ordering of the returned dataset. Both values are concatenated directly into an ORDER BY clause, a position in the SQL statement where identifiers cannot be safely quoted as string literals.

Before concatenation, each value passes through protectInjectionWithoutQuote(). This function inspects the input for a small set of blacklisted substrings, most notably the literal select. When it finds select, it wraps the value with $db->quote(). Quoting does not neutralize injection inside an ORDER BY clause, so the wrapping provides no security benefit. When the substring is absent, the value is concatenated unchanged.

Root Cause

The root cause is reliance on a blacklist sanitizer instead of a parameterized query or an allowlist of valid column names. protectInjectionWithoutQuote() inspects the substring content of the input and applies quoting only as a reaction to specific tokens. Because ORDER BY requires bare identifiers, the fix path ($db->quote()) does not prevent injection, and the non-fix path leaves the input untouched. Neither branch defends against attacker-controlled SQL.

Attack Vector

Exploitation requires two conditions. First, the attacker issues an initial request to prime session-stored sort defaults so the books() code path uses the attacker-supplied parameters. Second, the malicious payload includes a trailing decoy comment such as -- xselect that satisfies the blacklist's substring check for select without altering execution. The resulting payload is concatenated into the ORDER BY clause and executed by the database, enabling boolean-based, error-based, or time-based data extraction over an unauthenticated HTTP request.

Detection Methods for CVE-2026-101110

Indicators of Compromise

HTTP requests to Joomla endpoints invoking the Book Library books view with unusual field or direction parameter values containing SQL syntax, parentheses, CASE, IF, SLEEP, or BENCHMARK.
Requests containing trailing comment sequences such as -- xselect or other decoy tokens that end with the substring select.
Paired request patterns where a benign preflight request is immediately followed by a request carrying malicious ordering parameters from the same client.
Web server logs showing repeated requests to index.php?option=com_booklibrary with varying field values and anomalous response timing.

Detection Strategies

Deploy web application firewall rules that inspect field and direction parameters for SQL metacharacters and comment tokens even when a select substring is present.
Enable MySQL general query logging on affected hosts and alert on queries that contain ORDER BY fragments with subselects, conditional expressions, or unusual whitespace.
Correlate Joomla access logs with database error logs to surface syntax errors originating from the Book Library component.

Monitoring Recommendations

Monitor egress traffic from web servers for sudden increases in response size that correlate with Book Library requests, indicating data exfiltration.
Track authentication and privileged account activity in Joomla after any anomalous Book Library request to detect follow-on credential abuse.
Alert on repeated 500-series responses from the Book Library endpoint, which often accompany injection probing.

How to Mitigate CVE-2026-101110

Immediate Actions Required

Upgrade the OrdaSoft Book Library (Free) extension to version 6.4.6 or later on every Joomla instance.
Audit database and Joomla user credentials for signs of exposure and rotate any credentials that may have been read from the database.
Restrict public access to the Book Library component until patching is complete if the extension is not actively required.

Patch Information

Upgrade to Book Library (Free) version 6.4.6 or later. Refer to the OrdaSoft website for the current release and installation instructions. Verify the patched code replaces protectInjectionWithoutQuote() with a strict allowlist of sortable column names and validated sort directions.

Workarounds

Disable or uninstall the Book Library extension until the 6.4.6 update can be applied.
Enforce a web application firewall rule that rejects requests to the Book Library endpoint containing non-alphanumeric characters in field or direction parameters.
Restrict the database account used by Joomla to the minimum privileges required, removing FILE, CREATE, and cross-database read rights to limit the impact of successful injection.

bash

# Example ModSecurity rule blocking suspicious ORDER BY input to Book Library
SecRule REQUEST_URI "@contains com_booklibrary" \
  "chain,phase:2,deny,status:403,id:1026101110,msg:'Possible CVE-2026-101110 SQLi'"
  SecRule ARGS:field|ARGS:direction "@rx [^A-Za-z0-9_]" "t:none"