CVE-2026-102428 is a critical (CVSS 9.8) unauthenticated SQL injection in OrdaSoft Joomla CCK, versions before 8.3.16, through the order column for records. Update to 8.3.16 or later. Until then, disable the extension or block public access to its pages. It shares its fixed version with CVE-2026-102427.
What's affected
The record covers OrdaSoft Joomla CCK before 8.3.16. Use 8.3.16 or later and confirm it on the vendor's site, since the record links to the home page only.
The record is short. The order column for records was user provided and not properly validated.
How to check if you're exposed
This is a Joomla extension, so check inside Joomla.
- In the administrator area, open System, then Manage, then Extensions, and search for Joomla CCK.
- Read the installed version. The record covers Joomla CCK before 8.3.16.
- Check the files on the server too, since a site can carry a copy of an extension that is disabled but still reachable. Look for the extension's directory under
components.
If you manage many sites, list installed extensions across all of them and compare against this record.
What to do now
- Update the extension to 8.3.16 or later. Download it from the vendor, since the record points only to the vendor's home page.
- If you cannot update today, disable or uninstall the extension and remove its public pages from the menu.
- Use a database account for the site that has only the rights the CMS needs, which limits what a SQL injection can reach.
- Check your web server and application logs for unusual requests to the extension's pages since the record was published. A log review proves nothing in either direction by itself, but it can show you what to look at next.
- Rescan your inventory afterwards to confirm the vulnerable version is gone from every site.
Why it matters
The cause is input used in a query without validation, filed as CWE-89. Sort order and column names are a frequent weak spot, because developers parameterise values and then forget that an ORDER BY value is not a parameter.
The fix pattern is to accept a short list of known column names and directions and refuse everything else.
The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Is this the same issue as CVE-2026-102427?
No. That one is an upload flaw leading to code execution. This one is SQL injection. Both are fixed by moving to 8.3.16 or later, per the records.
Sources
Last reviewed: 19 October 2026.
