OrdaSoft Touch Slider EUVD-2026-94215

The affected site must have the OrdaSoft Touch Slider module (version below 5.4.6) installed and enabled so its modOsTouchSliderHelper::getAjax() handler is routed by Joomla's com_ajax dispatcher. No authentication, user session, CSRF token, or task parameter is required for the table-replacement path, so exploitation works against default configurations with the module present. The only real limiting factors are the presence/version of this specific module and that the image-deletion path relies on guessing sequential image IDs (trivial given their sequential nature); the destructive upload path has no such constraint.

This is a genuine access-control failure (CWE-284): the module's single AJAX handler, modOsTouchSliderHelper::getAjax(), is reachable through Joomla's core com_ajax dispatcher with no JFactory::getUser(), authorise(), or CSRF-token check, so the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is credible - remote, network-reachable, low-complexity, and fully unauthenticated. The most important signal is that the input's impact rating understates the described behavior: the vendor vector sets VI:L/VA:L, yet the description states the second path renames and replaces the ENTIRE #__os_touch_slider / #__os_touch_slider_text tables site-wide with attacker content, which is high-integrity destruction, not a low partial write - this discrepancy should be verified with the vendor. No EPSS score, KEV listing, or published POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net priority: the vulnerability class is trivially exploitable and destructive, making it a real risk for any site actually running this module, but the overall fleet risk is moderated by the product's narrow deployment footprint and the absence of exploitation signals. Treat as a patch-soon item for affected sites rather than an emergency fleet-wide event.

A remote, unauthenticated attacker sends a crafted multipart POST containing a ZIP file to the site's com_ajax endpoint targeting the Touch Slider module helper; because no authentication or CSRF check runs, the handler renames and replaces the module's entire slider tables with attacker-supplied content. Alternatively a simple unauthenticated GET with a guessed sequential ID deletes individual slider images. No public exploit code is identified at time of analysis, but the described request shapes are simple enough to weaponize quickly.