CVE-2026-27179
📋 TL;DR
MajorDoMo contains an unauthenticated SQL injection vulnerability in the commands module that allows attackers to execute arbitrary SQL queries without authentication. This enables extraction of admin credentials stored as unsalted MD5 hashes, leading to complete system compromise. All MajorDoMo installations with the vulnerable commands module are affected.
💻 Affected Systems
- MajorDoMo (Major Domestic Module)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover: attackers extract admin credentials, gain admin panel access, execute arbitrary code, and potentially pivot to other systems.
Likely Case
Credential theft and admin panel compromise leading to unauthorized control of the MajorDoMo system and connected devices.
If Mitigated
Limited impact due to network segmentation and proper authentication controls preventing exploitation.
🎯 Exploit Status
Time-based blind SQL injection using UNION SELECT SLEEP() syntax is documented in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version including pull request #1177
Vendor Advisory: https://github.com/sergejey/majordomo/pull/1177
Restart Required: No
Instructions:
1. Update to the latest MajorDoMo version that includes pull request #1177. 2. Apply the patch that adds parameterized queries to commands_search.inc.php. 3. Verify the $_GET['parent'] parameter is properly sanitized.
🔧 Temporary Workarounds
Disable commands module
linuxTemporarily disable the vulnerable commands module to prevent exploitation
# Remove or rename commands module files
mv /path/to/majordomo/modules/commands /path/to/majordomo/modules/commands.disabled
Web server access control
allBlock access to the vulnerable endpoint using web server configuration
# For Apache: Add to .htaccess or virtual host config
RewriteRule ^objects/\?module=commands - [F]
# For Nginx: Add to server block
location ~* ^/objects/\?module=commands { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MajorDoMo systems from untrusted networks
- Deploy a web application firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Test if /objects/?module=commands endpoint is accessible without authentication and accepts SQL injection payloads in the 'parent' parameterCheck Version:
Check MajorDoMo version in configuration files or admin panelVerify Fix Applied:
Verify that $_GET['parent'] parameter is properly sanitized in commands_search.inc.php and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /objects/?module=commands with SQL-like parameters
- Failed authentication attempts after SQL injection patterns
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, SLEEP) to /objects/?module=commands
- Unusual traffic patterns to the commands endpoint
SIEM Query:
source="web_logs" AND (url="/objects/" AND query="*module=commands*") AND (query="*UNION*" OR query="*SELECT*" OR query="*SLEEP*")