Unauthenticated SQL Injection in OrdaSoft Vehicle Manager (Free)

This six-file repository contains a standalone Python 3 exploit PoC, documentation, dependency list, and an example target list for CVE-2026-101108. Its sole executable, poc.py, uses requests and urllib3 to target OrdaSoft's Joomla com_vehiclemanager extension. It first fingerprints the component from public content and possible administrator manifest files, parses versions when available, and discovers catid and Itemid values from responses. It then targets anonymous category, search, and vehicle-listing routes where order_field and order_direction are reportedly concatenated into an unquoted SQL ORDER BY clause. The PoC supports check and exploit modes as well as threaded mass processing from a URL list. It tests four injection vectors: GET and POST delivery through each sortable parameter. Detection relies on SQL-error patterns; exploitation builds an error-based MySQL/MariaDB query containing a configurable SELECT subquery, parses tilde-delimited leaked values from the returned error content, and records results as JSONL. Default local output names include cve_2026_101108_results.jsonl, hits.txt, and exploited.txt. No shell, file-write, authentication-bypass, or remote-code-execution payload is present; the implemented impact is unauthenticated SQL query-result disclosure, with broader database impact dependent on the target database privileges and manually supplied SQL.