CVE-2026-88855: OrdaSoft Joomla Gallery SQL Injection Flaw

CVE-2026-88855 Overview

CVE-2026-88855 is an authenticated SQL injection vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7. The flaw resides in the extension's saveGallery() function, which routes user-supplied form data through a custom parser into Joomla's Input object. The values are then retrieved using ARRAY and STRING filter types, neither of which sanitizes SQL content. An attacker with the core.manage permission — a role scoped to managing a single gallery component rather than site-wide administration — can read and write arbitrary database content, including extracting password hashes from the #__users table.

Critical Impact
A low-privileged authenticated user can achieve full database compromise, including extraction of administrator password hashes via UNION-based SQL injection.

Affected Products

OrdaSoft Joomla Gallery extension versions prior to 6.2.7
Joomla sites with OrdaSoft Gallery installed and users assigned core.manage on the component
Any deployment exposing the gallery management interface to authenticated users

Discovery Timeline

2026-09-20 - CVE-2026-88855 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88855

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). The extension's saveGallery() method accepts several form parameters, including category_names[], catOrderIds, and image-ordering fields. These values are parsed through a hand-rolled routine and then read from Joomla's Input object using the ARRAY and STRING filter types.

Neither filter performs SQL sanitization. Both are designed for input shape validation, not for producing safe SQL literals. The unescaped values are concatenated directly into query strings without quoting or integer casting.

Exploitation requires authentication and the core.manage permission on the gallery component. This permission is often delegated to content editors or gallery administrators who are not intended to have database-level access. The scope of impact therefore extends well beyond the delegated administrative boundary.

Root Cause

The root cause is a misuse of Joomla's input filtering API. Developers relied on ARRAY and STRING filter types to receive form data safely, but these filters do not neutralize SQL metacharacters. The saveGallery() function then concatenated the filtered values directly into SQL statements. Parameterized queries or the Joomla DatabaseQuery builder with bound parameters were not used.

Attack Vector

An authenticated attacker with core.manage on the OrdaSoft Gallery component submits a crafted gallery save request. Malicious SQL payloads placed in category_names[], catOrderIds, or image-ordering fields pass unchanged into database queries. UNION-based injection allows extraction of arbitrary tables, including #__users password hashes. Write operations against the database are equally achievable, enabling account tampering and persistence.

Refer to the OrdaSoft Official Website for vendor advisory details.

Detection Methods for CVE-2026-88855

Indicators of Compromise

Unusual SQL keywords such as UNION, SELECT, SLEEP, or comment sequences appearing in POST bodies to the OrdaSoft Gallery save endpoints
Anomalous read access to the #__users table originating from web application database sessions
Newly created or modified Joomla user records with elevated privileges shortly after gallery save requests
Web server logs showing core.manage scoped users triggering repeated gallery save operations

Detection Strategies

Inspect Joomla request logs for saveGallery actions containing SQL metacharacters in category_names, catOrderIds, or image-ordering parameters
Deploy web application firewall rules that flag SQL syntax in multipart form fields destined for the OrdaSoft component
Correlate database query logs with application authentication events to identify queries originating from low-privileged users

Monitoring Recommendations

Enable MySQL or MariaDB general query logging on gallery-heavy Joomla sites for the duration of triage
Alert on any read from #__users initiated by requests to /administrator/index.php?option=com_ordasoft*
Review audit logs for unexpected password hash reads or user role modifications

How to Mitigate CVE-2026-88855

Immediate Actions Required

Upgrade the OrdaSoft Joomla Gallery extension to version 6.2.7 or later on all Joomla sites
Audit all users assigned the core.manage permission on the gallery component and revoke access that is not strictly required
Rotate all Joomla administrator and privileged user passwords, assuming hashes may have been exfiltrated

Patch Information

The vendor addressed the issue in OrdaSoft Joomla Gallery 6.2.7. Administrators should download the latest release from the OrdaSoft Official Website and apply it through Joomla's Extension Manager. Verify the installed version afterward via the Joomla administrator interface.

Workarounds

Restrict access to the gallery management interface using web server ACLs or IP allowlists until patching is complete
Temporarily remove the core.manage permission from non-administrator groups on the OrdaSoft Gallery component
Deploy WAF signatures that block SQL syntax in category_names[], catOrderIds, and image-ordering parameters

bash

# Example Apache restriction limiting OrdaSoft admin endpoints to trusted IPs
<LocationMatch "/administrator/index.php">
    Require ip 10.0.0.0/24
    Require ip 192.168.1.0/24
</LocationMatch>