CyberRota Analysis
AI-GeneratedThe OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7 contains a high-severity SQL injection vulnerability that allows authenticated users with core.manage permissions to execute arbitrary SQL queries. This flaw arises from insufficient sanitization of user input, enabling attackers to read and modify database content, including extracting password hashes from the user table. Joomla administrators and users of the affected extension should prioritize patching or upgrading to mitigate potential data breaches.
Original NVD Description
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.