CVE-2026-34455 Overview
CVE-2026-34455 is a SQL injection vulnerability in Hi.Events, an open-source event management and ticket selling platform. Multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() method without validation. The application uses PostgreSQL, which supports stacked queries, allowing attackers to execute arbitrary SQL statements. The flaw affects versions 0.8.0-beta.1 through versions earlier than 1.7.1-beta and is tracked under [CWE-89]. The maintainers patched the issue in version 1.7.1-beta.
Critical Impact
Unauthenticated attackers can inject arbitrary SQL through the sort_by parameter, leading to confidentiality compromise of database contents including event, user, and ticketing data.
Affected Products
- Hi.Events versions 0.8.0-beta.1 and later
- Hi.Events versions prior to 1.7.1-beta
- Deployments backed by PostgreSQL (supports stacked queries)
Discovery Timeline
- 2026-04-01 - CVE-2026-34455 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-34455
Vulnerability Analysis
The vulnerability resides in repository classes that accept a sort_by query string parameter from API consumers. Instead of validating the parameter against an allowlist of permitted column names, the code passes the raw value directly into Laravel Eloquent's orderBy() method. Eloquent does not sanitize column identifiers, so the input becomes part of the generated SQL statement.
Because Hi.Events runs on PostgreSQL, which permits stacked queries separated by semicolons, an attacker can append additional SQL statements after the legitimate ORDER BY clause. This converts a sorting parameter into a full SQL execution primitive without requiring authentication.
Root Cause
The root cause is missing input validation on the sort_by request parameter. Repository methods trust client-supplied identifiers and forward them to the query builder. The combination of unvalidated column identifiers and a database driver that accepts stacked queries enables injection beyond the original ORDER BY context.
Attack Vector
An unauthenticated remote attacker crafts an HTTP request to an affected Hi.Events API endpoint that accepts the sort_by parameter. The attacker supplies SQL syntax in place of a column name, terminating the original statement and appending a follow-up query. The PostgreSQL driver executes both statements, allowing data extraction from any accessible table.
No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-2qcp-24fh-fx6p and the patch commit for the technical fix.
Detection Methods for CVE-2026-34455
Indicators of Compromise
- HTTP requests containing sort_by values with SQL metacharacters such as semicolons, parentheses, or keywords like SELECT, UNION, INSERT, or pg_sleep.
- Web server access logs showing unusually long sort_by parameter values or URL-encoded SQL fragments.
- PostgreSQL logs recording unexpected queries originating from the Hi.Events application user, particularly statements unrelated to event or ticket retrieval.
Detection Strategies
- Inspect application and reverse proxy logs for requests where sort_by does not match the allowlist of known sortable columns.
- Enable PostgreSQL statement logging (log_statement = 'all') on staging or canary instances to identify anomalous query patterns.
- Deploy a web application firewall ruleset that flags SQL injection signatures in query string parameters, including stacked query terminators.
Monitoring Recommendations
- Alert on spikes in HTTP 500 responses from Hi.Events endpoints, which may indicate malformed injection attempts.
- Monitor PostgreSQL for query execution time anomalies that could indicate time-based blind SQL injection.
- Track outbound database traffic and connection patterns from the Hi.Events application tier for signs of bulk data extraction.
How to Mitigate CVE-2026-34455
Immediate Actions Required
- Upgrade Hi.Events to version 1.7.1-beta or later immediately. This is the only complete remediation.
- Audit PostgreSQL logs for suspicious queries dating back to deployment of any affected version.
- Rotate database credentials and any application secrets that may have been exposed through unauthorized queries.
Patch Information
The fix is included in Hi.Events 1.7.1-beta. The patch validates the sort_by parameter against an allowlist of permitted columns before passing it to Eloquent. See the GitHub Pull Request #1128, the patch commit 01e1aee2, and the v1.7.1-beta release notes.
Workarounds
- Deploy a WAF rule that rejects sort_by values containing non-alphanumeric characters or SQL keywords until the upgrade is complete.
- Restrict the database account used by Hi.Events to least-privilege access, removing rights to tables outside the application schema.
- Disable or front the application behind authentication enforcement at the reverse proxy layer if temporary internet exposure cannot be eliminated.
# Example WAF rule (ModSecurity) to block suspicious sort_by values
SecRule ARGS:sort_by "@rx [^a-zA-Z0-9_\-\.]" \
"id:1026034455,phase:2,deny,status:400,\
msg:'Hi.Events CVE-2026-34455 sort_by injection attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
