IT SBIT Services
Schneeberger
DEEN
CVE tracker

OrdaSoft Simple Membership: Unauthenticated SQL injection

CVE-2026-102782Critical 9.3Public exploit

← All vulnerabilities

Summary

The Simple Membership extension for Joomla, published by OrdaSoft, contains an SQL injection flaw in the task checkLoginPass. The endpoint requires no authentication, and user input reaches the database query without escaping or parameterization. An unauthenticated remote attacker can read or modify database content, such as member records, password hashes and administrator accounts, which may lead to account takeover. Any internet-facing Joomla site running an affected version is exposed.

Affected

  • OrdaSoft Simple Membership for Joomla, versions 1.0.0 to 7.4.0 according to the CNA record
  • The CVE text says "< 7.4.0" and VulDB says "up to 7.3.x", so it is unclear whether 7.4.0 itself is affected
  • Vendor confirmation of the affected range: Unknown.

Fixed in

  • Version 7.4.0 according to VulDB and public PoC write-ups; VulDB states that 7.4.0 or later adds parameterized queries and access checks on authentication endpoints
  • Vendor confirmation of the fixed version: Unknown. No OrdaSoft advisory or changelog was found.

Workaround

  • No vendor workaround found.
  • Restrict or disable the Simple Membership component if it is not essential.
  • A web application firewall rule for SQL injection patterns in login parameters may reduce risk, but it is not a fix and was not tested for this flaw.

Exploitation

  • Public proof of concept: yes, including a GitHub exploit entry and a PoC write-up with a Python tool. These were not reviewed or reproduced for this entry.
  • A Nuclei detection template was submitted (PR #17410), so public scanning tools can detect the flaw.
  • Known exploited: not marked as such in the sources checked; no CISA KEV entry was found.
  • EPSS: 0.00277.
  • CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

  • Check whether the Simple Membership component is installed on any internet-facing Joomla site.
  • Update to version 7.4.0 or later on such sites as soon as possible, and confirm the fixed version in the vendor release notes first.
  • If the site was exposed before patching, review web server and Joomla logs for requests to task=checkLoginPass and check the database for signs of compromise.
  • Rotate administrator and member credentials on affected sites.
  • Monitor logs for SQL injection patterns after patching.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:06.

Original description (NVD)

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed