Book Library Free Extension For Joomla
Monthly
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Reflected cross-site scripting in the OrdaSoft Book Library (Free) extension for Joomla, affecting versions below 6.4.6, lets an unauthenticated remote attacker inject arbitrary HTML and JavaScript that executes in a victim's browser session. The flaw lives in the publicly reachable book-detail view (site/views/view_book/tmpl/default.php), where the 'title' request parameter is echoed raw inside a double-quoted HTML attribute, so a value containing a double quote breaks out of the attribute and everything after it is rendered as markup. Exploitation requires passive user interaction - the attacker must deliver a crafted link to a victim (UI:P) - and impact scales with the victim's privileges, so a lured logged-in administrator yields a far more serious outcome than an anonymous visitor; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the first-party assessment rates this a genuine but modest-severity reflected XSS.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Reflected cross-site scripting in the OrdaSoft Book Library (Free) extension for Joomla, affecting versions below 6.4.6, lets an unauthenticated remote attacker inject arbitrary HTML and JavaScript that executes in a victim's browser session. The flaw lives in the publicly reachable book-detail view (site/views/view_book/tmpl/default.php), where the 'title' request parameter is echoed raw inside a double-quoted HTML attribute, so a value containing a double quote breaks out of the attribute and everything after it is rendered as markup. Exploitation requires passive user interaction - the attacker must deliver a crafted link to a victim (UI:P) - and impact scales with the victim's privileges, so a lured logged-in administrator yields a far more serious outcome than an anonymous visitor; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the first-party assessment rates this a genuine but modest-severity reflected XSS.