{"id":"CVE-2026-123489","published":"2026-11-06T15:17:18.313","lastModified":"2026-11-06T20:15:23.650","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f6gf-r952-rxg6","tags":[]},{"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-blind-sql-injection-via-getnext-getprev-criteria","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f6gf-r952-rxg6","tags":[]}],"hasPoc":true,"ai":null}