CVE-2026-123489 | BDVDB-2026-401253 Detail
craftcmscms
Description#
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.