{"id":"CVE-2026-32272","aliases":["GHSA-r54v-qq87-px5r"],"url":"https://o3.security/vulnerability/CVE-2026-32272","summary":"Craft Commerce: Blind SQL Injection via hasVariant/hasProduct","details":"## Overview\n\nCraft Commerce’s `ProductQuery::hasVariant` and `VariantQuery::hasProduct` properties bypass the `unset()` blocklist added to `ElementIndexesController` in GHSA-2453-mppf-46cj.\n\nThe blocklist only strips top-level Yii2 Query properties (`where`, `orderBy`, etc.), but `hasVariant` and `hasProduct` pass\nthrough untouched. Internally, these properties call `Craft::configure()` on a subquery without sanitization, re-introducing SQL injection via `criteria[hasVariant][where]=INJECTED_SQL`.\n\nAn authenticated control panel user can perform boolean-based blind SQL injection through the patched `ElementIndexesController` and extract arbitrary database contents.\n\n## Impact\n\n* Full database read access via blind SQL injection\n* Privilege escalation via security key extraction → forged admin sessions\n\n## Prerequisites\n* Authenticated control panel user\n* Commerce plugin installed\n* Products with variants in the database","published":"2026-04-13T20:25:50.420Z","modified":"2026-10-28T02:30:34.576771686Z","cvss":null,"epss":{"score":0.00304,"percentile":0.2321,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.6.0"}],"fix":{"url":"https://github.com/craftcms/commerce/pull/4232","label":"craftcms/commerce#4232"},"references":[{"type":"WEB","url":"https://github.com/craftcms/commerce/releases/tag/5.6.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32272.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2453-mppf-46cj"},{"type":"ADVISORY","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32272"},{"type":"FIX","url":"https://github.com/craftcms/commerce/pull/4232"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:34.576771686Z"}}