CVE-2026-22243

EIP tracks 1 public exploit for CVE-2026-22243. PoCs published by lukasz-rybak.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-22243, an authenticated SQL injection vulnerability in EGroupware's Nextmatch filter processing. The exploit leverages PHP type juggling to bypass input validation and inject arbitrary SQL commands.

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.