MajorDoMo allows attackers to steal admin passwords

Summary

An attacker can exploit this vulnerability to extract MajorDoMo admin passwords and gain unauthorized access to the admin panel. The vulnerability is caused by poor coding practices in the commands_search.inc.php file. To protect yourself, update to a fixed version of MajorDoMo or patch the vulnerable file to prevent unauthorized access to sensitive data.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
mjdm	majordomo	All versions	–

Original title

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] para...

Original description

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access.

nvd CVSS3.1 9.8

nvd CVSS4.0 8.8

Vulnerability type

CWE-89 SQL Injection

https://chocapikk.com/posts/2026/majordomo-revisited/ Third Party Advisory Exploit
https://github.com/sergejey/majordomo/pull/1177 Exploit Issue Tracking
https://www.vulncheck.com/advisories/majordomo-unauthenticated-sql-injection-in-... Third Party Advisory