Book Library SQLi leaks Joomla data, no auth (CVE-2026-101110) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-101110 is a critical unauthenticated SQL injection in the Joomla Book Library (Free) extension before version 6.4.6 that lets any remote attacker read data straight out of the site’s database, including Joomla user records and password hashes. No account is required and there is no user interaction; updating to 6.4.6 removes the flaw.

Overview

Book Library (Free), published by ordasoft.com, is a Joomla extension that renders book catalogs on a site. A request handled by site/booklibrary.php reaches the books() function, which reads the field and direction request parameters so it can sort the listing. Each value is passed through a helper named protectInjectionWithoutQuote() before use. That helper does not validate the value; it only scans for a small keyword blacklist. When it sees the literal substring select, it wraps the value in $db->quote() instead of rejecting the request.

The failure is that the sanitized value is then concatenated into an ORDER BY clause that is not itself quoted. Quoting a string inside an ORDER BY position changes its meaning but provides no defense, so an attacker can break out of the intended expression and append their own SQL. Two conditions make the path reachable: an initial request that primes session-stored sort defaults, and a trailing decoy comment such as -- xselect that satisfies the blacklist substring check without changing how the payload is interpreted.

Impact

Because the injection point sits in an ORDER BY clause, attackers can use boolean and time-based techniques to extract data row by row. The query runs with the privileges of the Joomla database account, so the reachable data usually includes #__users rows: usernames, email addresses, password hashes, and the secret used to sign session tokens. Recovering that secret lets an attacker forge a valid administrator session and take over the Joomla site. Leaked credentials also fuel credential-stuffing against other services, and the same database account may expose content from other extensions sharing the schema. Public sites running the extension are directly reachable over the network, which is why the CVSS score is 9.3.

Remediation

• Update Book Library (Free) to 6.4.6 or later. The vendor release is the only complete fix; there is no configuration toggle that closes the injection point.
• If you cannot patch immediately, uninstall the extension if it is not in active use, or block requests to site/booklibrary.php at your WAF or reverse proxy.
• Treat the database as potentially compromised if the site ran an affected version. Rotate the Joomla database password, the secret value in configuration.php, and any administrator credentials, then invalidate existing sessions.
• Review web server logs for requests carrying field, direction, or -- xselect patterns, and monitor for unusual ORDER BY fragments reaching index.php.

Security Insight

Joomla third-party extensions keep producing high-severity SQL injection because developers write bespoke input filters instead of binding parameters, and a keyword blacklist is a filter that fails by design: the -- xselect decoy shows how little effort is needed to satisfy it while leaving the payload intact. The pattern echoes the Balbooa Forms and Joomla custom field SQLi bugs that required the same two-step session priming. It also shows that the “quote it instead of reject it” instinct is dangerous wherever the value lands outside a string literal position, because quoting and escaping only protect data values - not SQL syntax. Site operators should treat extension inventory and update cadence as their real attack surface.

Related coverage: breach reports and security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs