Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Subrion CMS Admin Grid SQL Injection via Unwhitelisted Sort Parameter

CVE-2026-71292 · published 3 months ago
Summary

An attacker can inject malicious SQL code into Subrion CMS's admin grid by exploiting an unwhitelisted sort parameter, potentially allowing them to access sensitive database information, including administrator password hashes. This affects most admin grid controllers in Subrion CMS, which are often not properly configured to prevent this type of attack. To mitigate this risk, update to the latest version of Subrion CMS or apply a patch that addresses this vulnerability.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
intelliants subrion <= 4.2.1
Original advisory text
Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published5 Aug 2026
Updated4 Nov 2026
First seen5 Aug 2026
Sources
CVE-2026-71292 · NVD
CVE-2026-71292 · MITRE
CVE-2026-71292 · OSV
Track software like this
Free during beta