Ordasoft Joomla Gallery Extension For Joomla
Monthly
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla (both the free and paid editions) below version 6.2.7 allows any anonymous visitor to inject SQL through the publicly published mod_osgallery_search search box and read arbitrary database content. The showSearchResult() and showSearchResultAjax() endpoints take the textsearch/searchText request parameter and concatenate it directly into a LIKE clause without quoting or escaping, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the accompanying CVSS:3.1 assessment (PR:N/UI:N) both confirm the attack needs no authentication, no user interaction, and no special client configuration. Impact is scoped primarily to data disclosure - the authoritative assessment scores C:H/I:L/A:N because the injection point is a SELECT's LIKE clause - and no public exploit code was identified at time of analysis; exploitation is limited to sites running an affected Gallery version that actually publish the search module. This is a genuine high-priority vulnerability, so prioritise inventory of Joomla sites with the extension and the search module enabled, and upgrade to 6.2.7 or later.
Authenticated SQL injection in the OrdaSoft Joomla Gallery extension (both Free and commercial editions) for Joomla versions below 6.2.7 allows a user holding the delegated core.manage permission for the gallery component to execute arbitrary SQL against the site's database, including UNION-based extraction of #__users password hashes and full read/write access to stored data. Exploitation requires a valid Joomla account with that scoped gallery-management right - there is no unauthenticated path - so exposure is concentrated on sites that delegate gallery administration to non-fully-trusted users. No public exploit code or confirmed active exploitation was identified at the time of analysis, and no EPSS or KEV data was supplied; severity is assessed as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor-published CVSS 8.6).
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla (both the free and paid editions) below version 6.2.7 allows any anonymous visitor to inject SQL through the publicly published mod_osgallery_search search box and read arbitrary database content. The showSearchResult() and showSearchResultAjax() endpoints take the textsearch/searchText request parameter and concatenate it directly into a LIKE clause without quoting or escaping, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the accompanying CVSS:3.1 assessment (PR:N/UI:N) both confirm the attack needs no authentication, no user interaction, and no special client configuration. Impact is scoped primarily to data disclosure - the authoritative assessment scores C:H/I:L/A:N because the injection point is a SELECT's LIKE clause - and no public exploit code was identified at time of analysis; exploitation is limited to sites running an affected Gallery version that actually publish the search module. This is a genuine high-priority vulnerability, so prioritise inventory of Joomla sites with the extension and the search module enabled, and upgrade to 6.2.7 or later.
Authenticated SQL injection in the OrdaSoft Joomla Gallery extension (both Free and commercial editions) for Joomla versions below 6.2.7 allows a user holding the delegated core.manage permission for the gallery component to execute arbitrary SQL against the site's database, including UNION-based extraction of #__users password hashes and full read/write access to stored data. Exploitation requires a valid Joomla account with that scoped gallery-management right - there is no unauthenticated path - so exposure is concentrated on sites that delegate gallery administration to non-fully-trusted users. No public exploit code or confirmed active exploitation was identified at the time of analysis, and no EPSS or KEV data was supplied; severity is assessed as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor-published CVSS 8.6).
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.