OrdaSoft Book Library CVE-2026-101110

Requires the OrdaSoft Book Library (Free) extension for Joomla at a version below 6.4.6 to be installed and reachable. Exploitation is remote and unauthenticated (PR:N/UI:N) against default configurations, but has two concrete prerequisites drawn from the description: (1) an initial request must be sent first to prime the session-stored sort defaults so the vulnerable books() sort code path is reached, and (2) the injected field/direction value must include a trailing decoy comment such as -- xselect so the substring blacklist in protectInjectionWithoutQuote() treats the payload as containing select and merely quotes it rather than the payload being rejected - while the injection lands in an unquoted ORDER BY position where quoting is ineffective. No authentication, user interaction, or non-default setting beyond having the component enabled is needed.

All primary severity signals align on high risk: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated flaw with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), consistent with classic CWE-89 SQL injection that can read, modify, or destroy the backing database. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is currently theoretical-but-straightforward rather than observed in the wild - the absence of these signals is a data gap, not evidence of low risk. The one factor that tempers real-world urgency is prevalence: this is a third-party OrdaSoft extension for Joomla, not Joomla core, so the affected population is small. Net: technically a genuine unauthenticated pre-auth database-compromise bug (real priority for any site running the extension), but the limited install base keeps aggregate/internet-wide risk moderate. Note the description's two-step trigger (session priming plus a decoy comment) is a mild practical hurdle the AC:L rating does not reflect, though it is deterministic rather than a race.

A remote unauthenticated attacker first sends a request to the Book Library component to prime the session-stored sort defaults, then sends a follow-up request setting the field or direction parameter to a SQL payload terminated with a decoy -- xselect comment that slips past the keyword blacklist. Because the value is concatenated into an unquoted ORDER BY clause, the injection executes against the Joomla database, allowing extraction of user credentials/session data or modification of records. No public exploit code is identified at time of analysis, but the described technique is fully documented and reproducible.