CVE-2026-88854: OrdaSoft Joomla Gallery SQL Injection Flaw

CVE-2026-88854 Overview

CVE-2026-88854 is an unauthenticated SQL injection vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7. The flaw resides in the showSearchResult() and showSearchResultAjax() functions of the mod_osgallery_search module. These functions read the textsearch/searchText request parameters using $input->getVar(), which is not a valid Joomla filter method. The parameter value is concatenated directly into a SQL LIKE clause without escaping quotes or SQL syntax. Any anonymous visitor to a site running the search module can inject a UNION SELECT and exfiltrate arbitrary database content.

Critical Impact
Unauthenticated attackers can extract sensitive database contents — including user credentials, session tokens, and configuration secrets — from any Joomla site exposing the OrdaSoft Gallery search module.

Affected Products

OrdaSoft Joomla Gallery extension versions prior to 6.2.7
mod_osgallery_search Joomla module (publicly exposed search box)
Joomla sites publishing the OrdaSoft Gallery search widget

Discovery Timeline

2026-09-20 - CVE-2026-88854 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88854

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] rooted in unsafe request parameter handling. The OrdaSoft Gallery search module invokes $input->getVar() to retrieve the textsearch and searchText parameters submitted by anonymous visitors. Developers commonly assume getVar() applies a strict filter, but the method is not part of Joomla's documented filter API. It falls back to a default filter that strips HTML tags while leaving quotes, semicolons, and SQL operators untouched.

The returned string is inserted directly into a LIKE clause of a database query with no escaping, parameter binding, or prepared statement usage. This gives an attacker full control over the query syntax immediately after the LIKE operator. The module targeted, mod_osgallery_search, is a public-facing search box commonly published on gallery pages, so no authentication or user interaction is required to reach the vulnerable code path.

Root Cause

The root cause is a combination of two design mistakes. First, the code relies on a non-existent filter type in $input->getVar(), so the developer's intended sanitization never runs. Second, the query builder concatenates raw user input into the SQL string rather than using Joomla's quote(), escape(), or bound parameter APIs. Either defense alone would have prevented exploitation.

Attack Vector

An unauthenticated remote attacker submits a crafted HTTP request to the module's search endpoint, supplying a malicious value in textsearch or searchText. The payload closes the LIKE string, appends a UNION SELECT statement, and reads columns from tables such as #__users. Standard blind, error-based, and UNION-based SQL injection techniques all apply. Automated tooling such as sqlmap can enumerate and exfiltrate the entire database without credentials.

No verified proof-of-concept code is published in the enriched data. See the OrdaSoft Official Website for vendor advisories and patch details.

Detection Methods for CVE-2026-88854

Indicators of Compromise

HTTP requests to Joomla endpoints containing textsearch or searchText parameters with SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or encoded variants
Web server access logs showing repeated queries to mod_osgallery_search from a single source IP with varying payload lengths
Database logs recording anomalous UNION queries or queries referencing system tables originating from the Joomla application user
Unexpected outbound data volume from the web server following crafted search requests

Detection Strategies

Deploy WAF rules that inspect textsearch and searchText parameters for SQL metacharacters and common injection payload signatures
Enable database query logging and alert on UNION SELECT patterns issued by the Joomla application account
Correlate web access logs with database slow-query logs to identify long-running search queries indicative of blind SQL injection
Baseline normal search parameter length and content, then alert on statistical outliers

Monitoring Recommendations

Ingest Joomla access logs and MySQL/MariaDB audit logs into a centralized SIEM for correlation
Alert on any HTTP response to the search endpoint containing password hash patterns or base64 blobs
Track authentication anomalies for Joomla administrator accounts that may follow credential extraction

How to Mitigate CVE-2026-88854

Immediate Actions Required

Upgrade the OrdaSoft Joomla Gallery extension to version 6.2.7 or later on all Joomla installations
Audit web and database logs for exploitation attempts referencing textsearch or searchText parameters since the extension was installed
Rotate Joomla administrator credentials, API tokens, and any secrets stored in the database if exploitation is suspected
Temporarily unpublish the mod_osgallery_search module on sites that cannot be patched immediately

Patch Information

OrdaSoft addressed the flaw in Joomla Gallery version 6.2.7. Administrators should download the fixed release from the OrdaSoft Official Website and apply it through the Joomla Extensions Manager. Verify the installed version under Extensions → Manage → Manage after upgrade.

Workarounds

Disable or unpublish the mod_osgallery_search module until the patched extension can be installed
Add a WAF rule blocking requests to gallery search endpoints containing SQL keywords or single quotes in textsearch/searchText
Restrict database privileges for the Joomla application user to the minimum tables required, limiting the impact of a successful injection

bash

# Example ModSecurity rule to block SQLi payloads in the OrdaSoft search parameters
SecRule ARGS:textsearch|ARGS:searchText "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|sleep\s*\(|benchmark\s*\(|--|;)" \
    "id:1088854,phase:2,deny,status:403,log,msg:'CVE-2026-88854 OrdaSoft Gallery SQLi attempt'"