← Back to the live CVE advisory feed

CVE-2026-101110: Book Library (Free) extension for Joomla

Severity

9.3 (CRITICAL)

Vendor

JOOMLA

Affected versions

1.0.0-6.4.6

Patch status

Unknown

Published

2026-09-28T19:16:47.243

Modified

2026-09-28T19:16:47.243

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Joomla Extension – ordasoft.com – Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 – site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(), whose only real protection is a keyword blacklist that, on detecting the literal substring select, wraps the value in $db->quote() instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two conditions: a first request to prime session-stored sort defaults, and a trailing decoy comment (– xselect) that satisfies the blacklist’s substring check without altering the payload’s effect.

View the official NVD record for CVE-2026-101110

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.