Vehicle Manager Free CVE-2026-101108

No authentication, user interaction, or non-default configuration required: the vulnerable order_field and order_direction sort parameters are read at three anonymous-reachable frontend entry points of Vehicle Manager (Free) for Joomla - the category listing, the search page, and the all-vehicles listing - so any installation of the extension prior to 6.5.8 with a public-facing frontend is exploitable by a remote unauthenticated attacker. The primary limiting factor is that the injection lands in an unquoted ORDER BY clause, which constrains the attacker to blind/inferential extraction techniques (boolean or time-based) rather than direct UNION-based read or arbitrary write, slowing but not preventing data disclosure.

This is a genuine, credible vulnerability class (unauthenticated CWE-89 SQL injection) but a moderate real-world priority given the product footprint. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) correctly captures that exploitation is remote, low-complexity, and requires no authentication or user interaction - three anonymous frontend entry points (category listing, search, all-vehicles listing) are reachable. However, the flaw is specifically an unquoted ORDER BY injection: because the value lands after ORDER BY rather than in a quoted value context, the practical primitive is blind/boolean/time-based extraction rather than a straightforward UNION read or write, which makes the vendor's VI:H/VA:H (integrity and availability high) generous - real impact skews toward confidentiality. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so there is no signal of active exploitation or automated weaponization. SSVC-style read: exploitation status is 'none'/no public exploit identified, technical impact is meaningful (data disclosure) but the niche deployment base makes mass automation unlikely. Net: treat as a should-patch data-disclosure bug, not an emergency, absent evidence of exploitation.

An unauthenticated attacker browses the public Vehicle Manager frontend and appends a crafted order_field or order_direction sort parameter to the category, search, or all-vehicles listing request. Because the value is escaped but then concatenated into an unquoted ORDER BY clause, the escaping provides no protection and the attacker performs blind SQL injection to extract Joomla user credentials or session data from the database. No public proof-of-concept is identified at time of analysis, and the blind ORDER BY context means extraction is iterative rather than a single-shot dump.