OrdaSoft Joomla CCK: Unauthenticated SQL injection via record ordering
Summary
OrdaSoft Joomla CCK (OS CCK), a third-party Joomla extension, does not properly validate the user-supplied order column for records. An unauthenticated remote attacker can inject SQL statements through this parameter and may read or modify database content. The flaw affects Joomla sites with OS CCK versions 1.0.0 to 8.3.15 installed; a public proof of concept has been reported.
Affected
- OrdaSoft Joomla CCK (OS CCK, com_os_cck) versions 1.0.0 to 8.3.15
- Joomla core is not affected; sites without OS CCK installed are not affected
Fixed in
- Version 8.3.16 or later
- The vendor update server may still offer a vulnerable version; check the installed manifest version manually
Workaround
- Unknown. No vendor-published workaround found.
- If OS CCK is not needed, uninstall it.
- Restrict access to admin and frontend components where the business allows it.
Exploitation
- Not known as exploited; not listed in CISA KEV according to the sources.
- A public proof of concept has been reported (packetstorm entry dated 10 Oct 2026).
- A Nuclei detection template pull request exists; its merge status is unknown.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Check whether OS CCK is installed on any Joomla site and read the installed manifest version.
- Update to version 8.3.16 or later manually; do not rely on the auto-updater.
- Patch CVE-2026-102427 at the same time, as it is fixed in the same release.
- Uninstall OS CCK if it is not needed.
- Review web server and database logs for SQL error messages and unusual requests.
- Treat internet-facing installs as urgent because of the public proof of concept.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (2 repositories)
murrez/CVE-2026-102428 · MRdark-ops/sqli-cve-2026-102428
Research sources
- CVE-2026-102428 threatint record cve.threatint.com
- OrdaSoft website www.ordasoft.com
- Packetstorm entry PACKETSTORM:235077 vulners.com
- Nuclei template pull request 17421 github.com
- mysites.guru advisory blog mysites.guru
- HOL Guard CVE-2026-102428 hol.org
- Strix CVE-2026-102428 www.strix.ai
- OpenCVE CVE-2026-102427 (related) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:25.
Original description (NVD)
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.