CVE-2026-33350: LORIS Imaging Browser SQLi Vulnerability

CVE-2026-33350 Overview

CVE-2026-33350 is a SQL Injection vulnerability in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application that provides data and project management for neuroimaging research. The vulnerability exists in code sections responsible for the MRI feedback popup window within the imaging browser component. Prior to versions 27.0.3 and 28.0.1, attackers can exploit this SQL injection flaw to access or alter sensitive data stored on the server.

Critical Impact

Unauthenticated attackers can exploit SQL injection in the MRI feedback popup window to extract sensitive neuroimaging research data or modify database contents without authorization.

Affected Products

• LORIS versions prior to 27.0.3
• LORIS versions prior to 28.0.1
• LORIS Imaging Browser MRI Feedback Popup Component

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-33350 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-33350

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw exists within the MRI feedback popup window functionality of the LORIS imaging browser module. When processing user input for MRI feedback operations, the application fails to properly sanitize or parameterize SQL queries, allowing malicious SQL statements to be injected and executed against the backend database.

The attack can be performed remotely over the network without requiring authentication or user interaction. This makes the vulnerability particularly dangerous in research environments where LORIS instances may be exposed to network access for collaboration purposes. Successful exploitation allows attackers to read confidential information from the database, which may include sensitive neuroimaging research data, patient information, and project metadata.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the code handling the MRI feedback popup window. User-supplied input is concatenated directly into SQL queries without proper sanitization, allowing attackers to break out of the intended query context and inject arbitrary SQL commands. The affected code paths do not utilize prepared statements or other SQL injection prevention mechanisms, leaving the database exposed to manipulation.

Attack Vector

The attack vector is network-based, requiring no authentication or special privileges. An attacker can craft malicious HTTP requests to the MRI feedback popup window endpoint, embedding SQL injection payloads in vulnerable parameters. Since no user interaction is required, automated scanning tools could potentially discover and exploit this vulnerability at scale.

The vulnerability allows attackers to perform various SQL injection techniques including UNION-based injection to extract data from other database tables, blind SQL injection to infer database contents through application behavior, and potentially time-based injection attacks to enumerate database structure. The primary impact is unauthorized data access, which poses significant risks given the sensitive nature of neuroimaging research data that LORIS typically manages.

For technical details on the vulnerability mechanism and affected code paths, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33350

Indicators of Compromise

• Unusual SQL error messages in application logs related to the imaging browser or MRI feedback components
• Abnormal database queries containing SQL keywords like UNION, SELECT, DROP, or -- comment sequences
• Unexpected access patterns to the MRI feedback popup endpoints
• Database audit logs showing queries accessing tables or columns not typically used by the imaging browser feature

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting LORIS endpoints
• Monitor HTTP request logs for suspicious parameters containing SQL syntax in requests to /imaging_browser/ or MRI feedback-related URLs
• Deploy database activity monitoring to identify anomalous query patterns or unauthorized data access attempts
• Use SentinelOne Singularity Platform to detect post-exploitation behaviors following successful SQL injection attacks

Monitoring Recommendations

• Enable detailed logging for the LORIS imaging browser module and MRI feedback popup functionality
• Configure alerts for database errors that may indicate injection attempts
• Monitor for large data exfiltration from the database that could suggest successful exploitation
• Implement regular security scanning of LORIS instances to identify vulnerable versions

How to Mitigate CVE-2026-33350

Immediate Actions Required

• Upgrade LORIS to version 27.0.3 or 28.0.1 immediately to patch the SQL injection vulnerability
• Review database access logs for any signs of exploitation prior to patching
• Restrict network access to LORIS instances using firewall rules or VPN requirements
• Implement WAF rules to block SQL injection attempts as a defense-in-depth measure

Patch Information

The LORIS development team has released security patches in versions 27.0.3 and 28.0.1 that address this SQL injection vulnerability. Organizations running affected versions should update immediately. For detailed patch information and upgrade instructions, consult the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the MRI feedback popup functionality
• Implement strict input validation at the web server or reverse proxy level to filter SQL injection attempts
• Deploy network segmentation to limit database access from untrusted networks
• Apply database user permission restrictions to limit the potential impact of SQL injection attacks

# Example: Restrict network access to LORIS instance using iptables
# Allow only trusted networks to access the application
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP