The OrdaSoft Joomla Gallery extension for Joomla introduces an SQL injection flaw when it processes form data from the saveGallery() method. The function passes raw input through a custom parser and then retrieves it with Joomla’s Input object without proper sanitization. Field values such as category_names[], catOrderIds, and image-ordering are concatenated straight into an SQL query without quoting or integer casting. This allows any authenticated user with the core.manage permission to execute arbitrary SQL, read the entire database, and extract sensitive information such as password hashes via UNION‑based queries.

Vendors affected are OrdaSoft.com, specifically its Joomla Gallery extension (both the paid and free versions). Sites running any version of the extension earlier than 6.2.7 are vulnerable. The vulnerability applies to Joomla sites that have installed the gallery component and have granted users core.manage privileges to manage that component.

The CVSS score of 8.6 reflects a high impact; the EPSS score is not available, so the exploitation probability is unclear from public data, and the issue is not listed in CISA KEV. The flaw requires attacker authentication, but only a core.manage user (a privilege scoped to the gallery component rather than a full administrator) is needed. An attacker who obtains such credentials can manipulate the database, potentially compromising the entire site. Given that the vulnerability provides both read/write access and the ability to read password hashes, the risk to confidentiality, integrity, and availability is significant. Detailed exploitation requires standard SQL injection techniques and can be achieved once the authenticated session is established.