{"id":"CVE-2026-123488","published":"2026-11-06T15:17:18.133","lastModified":"2026-11-09T23:17:15.497","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6","tags":[]},{"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6","tags":[]}],"hasPoc":true,"ai":{"summary":"An unauthenticated SQL injection flaw in Craft CMS's element search endpoint allows attackers to inject malicious SQL via the unsanitized 'attribute' parameter, enabling full database compromise including credential manipulation and privilege escalation.","exploitability":"Exploitation is trivial for remote attackers due to lack of authentication, low complexity, and no user interaction required.","blast_radius":"Successful exploitation grants full database access, allowing attackers to escalate to administrator privileges by modifying the users table, leading to complete system compromise.","remediation":"Upgrade to Craft CMS 4.18.9 or later for the 4.x branch, or 5.11.2 or later for the 5.x branch.","detection":"Look for SQL injection patterns (e.g., stacked queries like '; DROP TABLE; --) in HTTP request parameters targeting the element search endpoint, especially in logs from web application firewalls or application access logs.","tags":["sql-injection","unauthenticated","privilege-escalation","web","cms"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:52:58.658Z"}}