Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-101108 – Unauthenticated SQL Injection – Vehicle Manager (Free) extension for Joomla ≤ 6.5.

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-101108 is a critical, unauthenticated SQL injection vulnerability in the Vehicle Manager (Free) extension for Joomla, developed by ordasoft.com. The flaw is rated 9.3 (Critical) and allows a remote, unauthenticated attacker to inject arbitrary SQL via the component’s sorting parameters, potentially exposing the full contents of the site’s database. It affects all releases from 1.0.0 through 6.5.7 and is fixed in 6.5.8.

Technical details

  • Root cause: site/vehiclemanager.php in the com_vehiclemanager component passes the order_field and order_direction sort parameters through a sanitizing/escaping function, but the resulting value is then inserted directly into an unquoted ORDER BY clause. Because the value is not enclosed in quotes, string-escaping provides no protection against injected SQL syntax.
  • Trigger conditions: the vulnerable code path is reachable from three anonymous, frontend entry points — the category listing view, the search view, and the all-vehicles listing view — meaning no authentication or prior session is required.
  • Attack vector: network-based, delivered via crafted GET/POST requests to the affected Joomla component; no user interaction is needed.
  • Impact: successful exploitation allows an attacker to manipulate backend SQL queries, enabling extraction of arbitrary database contents (e.g., via error-based techniques) and potentially further compromise of confidentiality, integrity, and availability of the underlying data.

Affected software

  • Vehicle Manager (Free) extension for Joomla, versions 1.0.0 through 6.5.7 (inclusive)
  • Component identifier: com_vehiclemanager
  • Vendor: ordasoft.com

Severity

  • CVSS Score: 9.3 (Critical)
  • CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Mitigation and recommended actions

  • Immediate: upgrade Vehicle Manager (Free) for Joomla to version 6.5.8 or later, which corrects the unquoted ORDER BY handling of the order_field and order_direction parameters.
  • If immediate patching is not possible: restrict or block public access to the vulnerable category listing, search, and all-vehicles listing endpoints of the component at the web server or WAF layer, and monitor logs for anomalous order_field/order_direction values (e.g., SQL keywords, quotes, or subquery syntax) until the update can be applied.
  • General: review database accounts used by Joomla/the extension to ensure least-privilege access, limiting the potential impact of any successful injection.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge