CVE-2026-3786
MEDIUMeasycms < 1.6 - SQL Injection via _order Parameter in Request Parameter Handler
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-3786. PoCs published by XiaomingX, Mefhika120, snapdowgg.
AI-analyzed exploit summary The repository contains a functional exploit for CVE-2026-3786, demonstrating SQL injection leading to RCE and shell upload. The exploit targets a vulnerable endpoint in a PHP-based application (likely ThinkPHP) and includes payloads for time-based SQLi, RCE, and database name extraction.
Description
A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (3)
The repository contains a functional exploit for CVE-2026-3786, demonstrating SQL injection leading to RCE and shell upload. The exploit targets a vulnerable endpoint in a PHP-based application (likely ThinkPHP) and includes payloads for time-based SQLi, RCE, and database name extraction.
This repository contains a functional exploit for CVE-2026-3786, demonstrating SQL injection leading to RCE via file upload and command execution. The exploit includes payloads for time-based SQLi, shell upload, and database name extraction.
The repository contains a functional exploit for CVE-2026-3786, demonstrating SQL injection leading to RCE via command injection in the `_order` parameter of an admin endpoint. It includes shell upload, database name extraction, and RCE testing capabilities.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L