CVE-2026-71292

HIGH

Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter

Title source: cna
STIX 2.1

Description

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0032
EPSS Percentile 24.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
intelliants/subrion < 4.2.1
Published Aug 05, 2026
Tracked Since Aug 05, 2026