Executive brief
OrdaSoft Joomla Gallery is a content gallery extension for Joomla websites. The public search module contains an unauthenticated SQL injection vulnerability that allows any anonymous website visitor to read arbitrary data from the site's database by crafting malicious search queries. This could expose sensitive business data, customer information, or credentials stored in the database.
Technical details
The vulnerability exists in the showSearchResult() and showSearchResultAjax() functions, which read the textsearch/searchText request parameter and pass it unsanitized into a SQL LIKE clause. The $input->getVar() method only strips HTML tags but does not escape SQL syntax or quotes, allowing UNION SELECT injection. The search endpoint (mod_osgallery_search) requires no authentication and is publicly accessible by design.
Affected products
- OrdaSoft Joomla Gallery < 6.2.7
Timeline
- 2026-09-20: disclosed