EUVD-2026-92449
GHSA-ch52-jhqg-qhvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running OrdaSoft CCK
-
DeliveryCraft malicious order-column parameter
-
ExploitInject SQL via unvalidated input
-
ExecutionExtract or modify database records
-
ImpactHarvest credentials / compromise site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the vulnerable extension installed - remote unauthenticated exploitation (PR:N/UI:N) is possible against default configurations of any Joomla site running OrdaSoft Joomla CCK prior to version 8.3.16. The specific prerequisite is reachability of the feature that accepts the user-provided record 'order' column parameter, which is passed into a SQL query without proper validation. The principal limiting factor is prevalence: exploitation requires the target to actually have this third-party OrdaSoft CCK extension deployed, so unaffected Joomla installations are not at risk. |
| Impact | All exploitability signals point to a genuinely high-priority flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the full-impact triad (VC:H/VI:H/VA:H) is consistent with a classic SQL injection (CWE-89) that can read, modify, and destroy database contents. The 9.3 base score is therefore well-aligned with the technical description rather than being inflated. However, several key real-world signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC/exploit-code indicator, so active or widespread exploitation cannot be asserted - exploitation status is 'no public exploit identified at time of analysis.' The main factor tempering absolute risk is deployment footprint: OrdaSoft Joomla CCK is a third-party Joomla extension from a single niche vendor, so the affected population is far smaller than a core platform flaw. Net assessment: treat as high-priority patching for any site actually running this extension, but note the priority is bounded by limited prevalence and by the absence of EPSS/KEV/POC corroboration. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a public Joomla site running OrdaSoft CCK below 8.3.16 and sends a crafted request manipulating the record 'order' column parameter, which is used unvalidated in a SQL query. By injecting SQL into that sort/order parameter, the attacker extracts credentials and session data or alters database records. No public exploit code is confirmed in the provided data, but the injection point is simple enough to weaponize quickly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
RemediationAI
Vendor-released patch: upgrade OrdaSoft Joomla CCK to version 8.3.16 or later, which is the fixed threshold from the available data. Confirm the update through the vendor site at https://www.ordasoft.com/. If upgrading immediately is not possible, reduce exposure by disabling the CCK extension if it is not essential, restricting unauthenticated access to features that accept the record order parameter, or adding WAF rules to block SQL injection attempts against those endpoints; these compensating controls can break CCK record ordering or related functionality and do not replace patching. No public exploit code was identified at time of analysis, but because the flaw is unauthenticated and remotely reachable, prioritize affected sites and monitor database and web logs for anomalous SQL activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection (CWE-89) in the OrdaSoft Joomla CCK component, a third-party content construction kit for Joomla. The record 'order' column is accepted from user input and inserted into a SQL query without proper neutralization, allowing unauthenticated remote attackers to alter query logic and potentially read, modify, or delete database contents. The CPE string cpe:2.3:a:ordasoft.com:ordasoft_joomla_cck:*:*:*:*:*:*:*:* identifies the affected component across versions, with 8.3.16 as the fixed threshold. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and the independent CVSS 3.1 assessment agree on network reachability, no authentication or user interaction, and high impact to confidentiality, integrity, and availability. Joomla core is not directly affected; risk is limited to installations running the vulnerable extension, and no public exploit or KEV entry was present in the provided intelligence.
Know when Ordasoft Joomla Cck gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network SQL injection via an unvalidated parameter gives PR:N/AC:L/AV:N, and database read/write/destroy justifies C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
Executive ViewAI
OrdaSoft Joomla CCK, a third-party Joomla extension, contains a critical unauthenticated SQL injection affecting versions before 8.3.16; any organization running an affected instance exposes its Joomla database to unauthorized read, modification, or destruction. Because no vendor-released patch has been identified and the flaw is remotely exploitable without credentials, leadership should treat this as an urgent exposure for sites that have the extension installed, even though prevalence is limited to those deployments. No public exploit was identified at time of analysis, but the potential for full database compromise warrants immediate inventory and containment.
No vendor-released patch identified at time of analysis; disable or uninstall OrdaSoft Joomla CCK, restrict network access to affected endpoints, deploy WAF virtual patching for SQL injection, monitor database and web logs, and rotate Joomla database credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB