An authenticated SQL injection vulnerability in the OrdaSoft Joomla Gallery extension allows attackers with core.manage privileges to execute arbitrary database queries and extract sensitive information.

This is an improper neutralization of special elements used in an SQL command (CWE-89). The saveGallery function fails to sanitize input parameters including category_names, catOrderIds, and image-ordering, which allows an authenticated user with core.manage privileges to perform unauthorized database operations.

Successful exploitation of this vulnerability grants an attacker full read and write access to the underlying database. This high-severity risk, reflected by a CVSS score of 8.6, enables the extraction of sensitive data such as user password hashes from the Joomla user table, potentially leading to a full site takeover and significant reputational damage.

Immediate Action: Update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review database query logs for suspicious activity, particularly queries originating from the gallery management interface that contain unusual SQL syntax or UNION statements.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, which can provide temporary protection while the update is being staged.

Public Exploit Available: No

Given the potential for complete database compromise, organizations using the OrdaSoft Joomla Gallery extension should prioritize upgrading to version 6.2.7 immediately. Security teams should also audit accounts currently granted core.manage permissions to ensure that access is restricted to trusted users, as this vulnerability specifically leverages the privileges assigned to that user role to gain unauthorized access to the database.