CVE-2026-1059
📋 TL;DR
This CVE describes a SQL injection vulnerability in FeMiner wms through commit 9cad1f1b179a98b9547fd003c23b07c7594775fa. Attackers can exploit the /src/chkuser.php file by manipulating the Username parameter to execute arbitrary SQL commands. All users running affected versions are vulnerable to remote attacks.
💻 Affected Systems
- FeMiner wms
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential authentication bypass leading to full system takeover.
Likely Case
Unauthorized data access, credential theft, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit disclosed publicly; SQL injection via Username parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject malicious Username parameter values
Modify /src/chkuser.php to sanitize Username input before SQL processing
Web Application Firewall Rule
allBlock SQL injection patterns targeting /src/chkuser.php
Add WAF rule: deny requests to /src/chkuser.php containing SQL keywords in Username parameter
🧯 If You Can't Patch
- Network segmentation: Isolate FeMiner wms instances from critical systems
- Implement strict access controls and monitor all database queries from the application
🔍 How to Verify
Check if Vulnerable:
Check if /src/chkuser.php exists and examine code for unsanitized Username parameter usage in SQL queriesCheck Version:
Check git commit hash: git log --oneline -1Verify Fix Applied:
Test with SQL injection payloads in Username parameter; successful queries should be blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL syntax in Username field
Network Indicators:
- HTTP POST requests to /src/chkuser.php containing SQL keywords (UNION, SELECT, etc.)
SIEM Query:
source="web_logs" AND uri="/src/chkuser.php" AND (Username="*UNION*" OR Username="*SELECT*" OR Username="*OR*1=1*")