OrdaSoft Joomla Gallery CVE-2026-88854

Exploitable when the site publishes the OrdaSoft gallery search module (mod_osgallery_search), which is a public, commonly-enabled search box - the showSearchResult()/showSearchResultAjax() endpoints reachable by any anonymous visitor. No authentication, user interaction, or special client configuration is required. The only real limiter is deployment scope: the target must be running the OrdaSoft Joomla Gallery extension (free or paid) at a version below 6.2.7 with the search module active; sites that do not publish the search box would not expose these endpoints.

This is a genuine high-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction - the strongest possible exposure profile - and the description corroborates it: mod_osgallery_search is a publicly-published search box requiring no login, so PR:N is credible rather than optimistic. CWE-89 SQL injection concatenated directly into a LIKE clause with a UNION SELECT gives an anonymous attacker arbitrary database read, including the Joomla #__users password-hash table (the classic pivot to admin takeover). No EPSS score, KEV listing, or public POC was provided, so there is currently no evidence of active exploitation or automated weaponization - the risk is potential rather than confirmed-in-the-wild. I dispute the vendor's VI:H/VA:H integrity/availability ratings: a LIKE-clause UNION-based SELECT is fundamentally a read primitive, and Joomla's mysqli layer does not permit stacked queries by default, so direct write/destroy impact is limited (VI:L/VA:N is more defensible than VI:H/VA:H). The confidentiality impact, however, is fully justified at C:H. Net: a real, easily-reachable data-disclosure flaw in a niche product - patch promptly where deployed, but the low real-world footprint tempers urgency versus a ubiquitous product.

An anonymous visitor loads a page hosting the OrdaSoft gallery search module and submits a crafted textsearch/searchText value containing a UNION SELECT payload. Because the parameter is read via $input->getVar() (not a real Joomla filter) and concatenated unescaped into a LIKE clause, the injected query executes and returns arbitrary table data - for example the #__users table - in the search response. No public exploit code was identified at time of analysis, but the mechanism is straightforward manual SQL injection requiring no authentication.