Real Estate Manager EUVD-2026-88434

No special conditions - remote unauthenticated exploitation against default configurations of the OrdaSoft Real Estate Manager (Free) Joomla extension prior to 6.7.9. The vulnerable order_field parameter is exposed on public, pre-authentication frontend pages (property listing, category browsing, and search results), so no login, user interaction, or non-default setting is required. The only prerequisites are that the extension is installed/enabled and its listing pages are reachable. The practical limiting factor is that the sink is an ORDER BY clause, which favors blind data-read techniques over direct data modification.

The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects an unauthenticated, network-reachable SQL injection with no user interaction - genuinely severe on paper. However, several real-world-risk moderators apply. Exploitation status is 'no public exploit identified at time of analysis': the input carries no EPSS score, no CISA KEV listing, and no POC reference (the only reference is the vendor homepage ordasoft.com with no dedicated advisory). The injection point is an ORDER BY clause, which is a real but comparatively constrained SQLi primitive: it supports blind/subquery-based and boolean/time-based extraction (justifying high confidentiality) but rarely yields data modification or destruction on Joomla's default mysqli stack, where stacked queries are disallowed - so the vendor's VI:H/VA:H (integrity and availability HIGH) appear inflated relative to a read-oriented ORDER BY injection. Net: this is a legitimate, easy-to-reach unauthenticated flaw, but the affected product is a niche third-party Joomla extension with a small deployment footprint, so the practical priority is moderate rather than critical. This is one of several near-identical OrdaSoft Joomla-extension ORDER BY SQLi disclosures reported via Joomla's CVE program (cf. Book Library Free, CVE-2026-101110).

An unauthenticated visitor to a Joomla site running Real Estate Manager (Free) < 6.7.9 submits a crafted order_field value in a frontend property-listing, category-browse, or search request. Because order_field is concatenated directly into an unquoted ORDER BY clause with no column allow-list or cast, the attacker injects blind boolean/time-based subqueries to enumerate and exfiltrate database contents (user credentials, session data). No POC or active exploitation is currently documented.