Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102782— Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

Quick assessment

Affected
ordasoft.com OrdaSoft Simple Membership extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joomla扩展 – ordasoft.com – OrdaSoft Simple Membership 版本低于7.4.0中存在未认证的SQL注入漏洞。site/simplemembership.php中，当参数task=checkLoginPass被调用时，没有进行任何身份验证或访问控制检查。该处理程序通过Joomla通用的、不进行数据清理的输入过滤器读取登录请求参数，该过滤器仅剥离HTML/脚本标签，但不会对引号或SQL语法进行任何处理，随后将该参数直接拼接到查询字符串中，既未进行转义，也未使用参数化查询。

CVSS 9.3 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102782

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ordasoft.com OrdaSoft Simple Membership extension for Joomla 1.0.0-7.4.0 -

II. Public POCs for CVE-2026-102782

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102782

请登录查看更多情报信息。

Other References for CVE-2026-102782 (1)

IV. Related Vulnerabilities

Same vendor: ordasoft.com
Same weakness: CWE-89

V. Comments for CVE-2026-102782

No comments yet

Leave a comment