CVE-2026-1105
📋 TL;DR
This SQL injection vulnerability in EasyCMS allows attackers to manipulate database queries through the _order parameter in /UserAction.class.php. Attackers can potentially read, modify, or delete database content remotely. All users running EasyCMS versions up to 1.6 are affected.
💻 Affected Systems
- EasyCMS
📦 What is this software?
Easycms by Easycms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation in the CMS database.
If Mitigated
Limited impact with proper input validation and database permission restrictions.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative CMS or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the _order parameter before processing
Modify /UserAction.class.php to validate _order parameter using whitelist approach
Web Application Firewall Rule
allBlock SQL injection patterns targeting the _order parameter
Add WAF rule to detect and block SQL injection attempts in _order parameter
🧯 If You Can't Patch
- Restrict network access to EasyCMS instance using firewall rules
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Check if /UserAction.class.php exists and contains vulnerable code handling _order parameterCheck Version:
Check EasyCMS version in configuration files or admin panelVerify Fix Applied:
Test with SQL injection payloads against the _order parameter to confirm blocking📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
Network Indicators:
- HTTP requests with SQL injection patterns in _order parameter
SIEM Query:
web.url:*UserAction.class.php* AND web.param:_order:*sql*