CVE-2026-71292

Name of the Vulnerable Software and Affected Versions Subrion CMS (affected versions not specified)

Description The admin grid sorting helper gridGetSorting() in includes/classes/ia.base.controller.admin.php fails to properly validate the sort GET parameter. While the function attempts to whitelist the direction parameter, it falls back to using the raw, attacker-supplied sort parameter when the requested key is missing from the $ gridSorting whitelist array. This value is then inserted into a SQL query using sprintf() with only backtick-quoting and no escaping. An authenticated admin session can use a backtick in the payload to break out of the identifier context and perform SQL injection, such as error-based extraction via EXTRACTVALUE() or time-based extraction via SLEEP(), to retrieve database contents including administrator password hashes. This issue affects the majority of admin grid controllers, including pages.php, transactions.php, languages.php, and members.php.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.