# CVE-2026-101110: OrdaSoft Book Library SQL injection in ORDER BY clause

Source: https://junglewise.ai/threats/cve-2026-101110-joomla-extension-ordasoft-com-unauthenticated-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101110 · Severity: info · Published 2026-09-28

OrdaSoft's Book Library is a Joomla extension for managing digital book catalogs. An unauthenticated attacker can inject arbitrary SQL code through the sort parameters in the books listing page, potentially exposing or modifying the entire database. The vulnerability requires two steps: first priming a session state, then crafting a specially-formatted request that bypasses the extension's protection mechanism.

Vendors: [OrdaSoft](https://junglewise.ai/threats/vendors/ordasoft).

## Quick answers

**Is CVE-2026-101110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101110 being exploited in the wild.

**How severe is CVE-2026-101110?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** OrdaSoft Book Library < 6.4.6.

**Is there a fix for CVE-2026-101110?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101110 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101110?** Check whether you run OrdaSoft Book Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The books() function in site/booklibrary.php accepts user-supplied "field" and "direction" request parameters and attempts to sanitize them via protectInjectionWithoutQuote(), which only blacklists the literal substring "select" and wraps matching values in $db->quote(). However, quoting provides no protection in an unquoted ORDER BY context. An attacker can bypass the blacklist by appending a decoy comment (-- xselect) to inject arbitrary SQL. The attack requires a prior request to establish session-stored sort defaults.

## Affected products

- OrdaSoft Book Library < 6.4.6

## Timeline

- 2026-09-28: disclosed

## References

- [https://www.ordasoft.com/](https://www.ordasoft.com/)

## Related threats

- [OrdaSoft Book Library reflected cross-site scripting in book detail page](https://junglewise.ai/threats/cve-2026-101111-joomla-extension-ordasoft-com-reflected-cross-site-scripting-in)