CVE-2026-101110 is a critical (CVSS 9.8) unauthenticated SQL injection in Book Library, a Joomla extension from OrdaSoft, in versions before 6.4.6. Update to 6.4.6 or a later release from the vendor. If you cannot update now, disable the extension, because anyone on the internet can reach the vulnerable code.
What's affected
The record covers OrdaSoft Book Library (the free edition) in versions before 6.4.6. Version 6.4.6 or later is the target, but the record links only to the vendor's home page, so confirm the exact fixed release there.
The flawed code is the books() function in site/booklibrary.php. It takes the field and direction request parameters and concatenates them into an ORDER BY clause.
How to check if you're exposed
This is a Joomla extension, so check inside Joomla.
- In the administrator area, open System, then Manage, then Extensions, and search for Book Library.
- Read the installed version. The record covers Book Library before 6.4.6.
- Check the files on the server too, since a site can carry a copy of an extension that is disabled but still reachable. Look for the extension's directory under
components.
If you manage many sites, list installed extensions across all of them and compare against this record.
What to do now
- Update the extension to 6.4.6 or later. Download it from the vendor, since the record points only to the vendor's home page.
- If you cannot update today, disable or uninstall the extension and remove its public pages from the menu.
- Look at your database account for the site. If it can do more than the CMS needs, tighten it to limit damage from any SQL injection.
- Check your web server and application logs for unusual requests to the extension's pages since the record was published. A log review proves nothing in either direction by itself, but it can show you what to look at next.
- Rescan your inventory afterwards to confirm the vulnerable version is gone from every site.
Why it matters
This is classic SQL injection, filed as CWE-89. The record explains the failure well: the code runs request values through a keyword blacklist and then concatenates them into the query. Blacklists are easy to get wrong. Worse, the value lands in an ORDER BY clause, where quoting a value gives no protection, because a column name is not a string literal.
The lasting fix is not a longer blacklist. It is to map the user's choice onto a fixed list of allowed column names and directions, and to use parameterised queries everywhere else.
The record gives no sign of exploitation in the wild and the KEV flag is false.
Quick check
Why does quoting a value not help here?
In an ORDER BY clause the input is read as a column name or direction, not as a quoted string. Quoting only protects string literals, so the safe approach is an allow list of column names.
Sources
Last reviewed: 19 October 2026.
