Description
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 4.0.0 – < 4.18.9, 5.0.0 – < 5.11.2 | 4.18.9 |
References
- GitHub Security Advisory (GHSA-f6gf-r952-rxg6) vendor-advisory
- VulnCheck Advisory: Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria third-party-advisory