Threats tagged 'ghsa-hv58-qqxr-w5r2'

An unauthenticated SQL Injection vulnerability exists in the ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 through 6.4.6. The vulnerability arises from improper sanitization of user-supplied 'field' and 'direction' parameters in the books() function, which are concatenated directly into an unquoted ORDER BY clause. This flaw allows attackers to manipulate SQL queries without proper neutralization, potentially leading to high-impact consequences.