The OrdaSoft Joomla Gallery extension for Joomla contains a critical unauthenticated SQL injection vulnerability that allows remote attackers to read or modify arbitrary database content.

This flaw exists because the showSearchResult and showSearchResultAjax functions fail to properly escape user input in the textsearch and searchText parameters. As a result, an unauthenticated attacker can inject arbitrary SQL commands via the public-facing search module to compromise the database.

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 9.3, this vulnerability could be leveraged to exfiltrate sensitive user data, modify administrative credentials, or cause significant service disruption, leading to potential regulatory non-compliance and reputational damage.

Immediate Action: Update the OrdaSoft Joomla Gallery extension to version 6.2.7 or higher immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Monitor web server access logs for anomalous request patterns targeting the mod_osgallery_search endpoint, specifically looking for SQL syntax characters or UNION SELECT statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP GET and POST parameters until the extension can be updated.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Given the critical severity and the existence of a public proof-of-concept, organizations using the OrdaSoft Joomla Gallery extension must prioritize patching this vulnerability. Failure to update the software exposes the backend database to full compromise by any anonymous visitor, necessitating immediate remediation to prevent unauthorized data access.