CVE-2026-67689

CRITICAL

FineAdmin 1.0 - Unauthenticated SQL Injection via ORDER BY Clause Field and Order Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-67689. PoCs published by qflksheep.

AI-analyzed exploit summary This repository provides a functional PoC for CVE-2026-67689, demonstrating SQL injection via unsanitized `field` and `order` parameters in FineAdmin.Mvc's paginated endpoints. The exploit leverages MySQL's ORDER BY clause to execute error-based injection (EXTRACTVALUE) and extract database information.

Description

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints

Exploits (1)

github WORKING POC
by qflksheep · poc
https://github.com/qflksheep/CVE-2026-67689-FineAdmin.Mvc-vulnerability

This repository provides a functional PoC for CVE-2026-67689, demonstrating SQL injection via unsanitized `field` and `order` parameters in FineAdmin.Mvc's paginated endpoints. The exploit leverages MySQL's ORDER BY clause to execute error-based injection (EXTRACTVALUE) and extract database information.

Classification
Working Poc 98%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: FineAdmin.Mvc (unspecified version, but vulnerable to ORDER BY clause injection)
Auth required
Prerequisites: Valid session cookie (Loginkey) · Access to vulnerable paginated endpoints (e.g., /Permissions/User/List)
mistral-large-3 · analyzed Aug 07, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0069
EPSS Percentile 49.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Published Aug 06, 2026
Tracked Since Aug 07, 2026