Ordasoft Joomla Cck
Monthly
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.