CVE-2026-36962: MuuCMF T6 SQL Injection Vulnerability

CVE-2026-36962 Overview

CVE-2026-36962 is a SQL injection vulnerability in MuuCMF T6 version 1.9.4.20260115. The flaw resides in the keyword parameter of the /index/controller/Search.php endpoint. An unauthenticated remote attacker can inject arbitrary SQL statements through this parameter. Successful exploitation allows full database compromise, unauthorized administrative access, and potential remote code execution by writing malicious files to the underlying file system. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can compromise the entire MuuCMF database, escalate to administrator, and pivot to remote code execution by writing files through SQL injection.

Affected Products

MuuCMF T6 version 1.9.4.20260115
The /index/controller/Search.php endpoint
Deployments hosted from the Gitee MuuCMF repository

Discovery Timeline

2026-05-11 - CVE-2026-36962 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-36962

Vulnerability Analysis

The vulnerability exists in the search functionality of MuuCMF T6. The application accepts a user-supplied keyword parameter and concatenates it into a SQL query without proper sanitization or parameterization. Because the endpoint is reachable without authentication, any remote user can submit crafted input over the network. The injection point provides direct interaction with the backend database, enabling data extraction, modification, and authentication bypass through manipulation of result sets.

Beyond standard data theft, an attacker can chain the injection with database file-writing primitives such as SELECT ... INTO OUTFILE to drop webshells into web-accessible directories. This converts a database-layer flaw into full remote code execution on the host. Public technical analysis is available in the MuuCMF SQLi write-up.

Root Cause

The root cause is improper neutralization of special elements in the keyword query parameter [CWE-89]. The Search.php controller builds SQL statements through string concatenation rather than prepared statements with bound parameters. Input validation and output encoding are absent, leaving the query parser exposed to attacker-controlled syntax.

Attack Vector

The attack vector is the network. An attacker sends a crafted HTTP request to /index/controller/Search.php with a malicious keyword value containing SQL metacharacters and payloads. No credentials, user interaction, or prior access are required. The exploitation flow typically begins with boolean-based or UNION-based extraction to enumerate the schema, followed by extraction of administrator credential hashes, and concludes with INTO OUTFILE writes targeting the web root for shell deployment.

No verified proof-of-concept code is published in the enriched CVE data. Refer to the GitHub blog SQL injection analysis for technical reproduction details.

Detection Methods for CVE-2026-36962

Indicators of Compromise

HTTP requests to /index/controller/Search.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or INTO OUTFILE in the keyword parameter.
Unexpected files appearing in the MuuCMF web root or upload directories, particularly PHP files with random names.
Database error responses or anomalous response time variations correlated with requests to the search endpoint.
New or modified administrator accounts in the MuuCMF user tables without corresponding admin console activity.

Detection Strategies

Deploy web application firewall rules that flag SQL metacharacters and tautology patterns submitted to the keyword parameter.
Enable database query logging and alert on queries originating from the search controller that contain UNION SELECT or file-system functions.
Correlate web server access logs with file system change events in the MuuCMF document root to surface webshell drops.

Monitoring Recommendations

Monitor outbound connections initiated by the PHP process to identify post-exploitation command and control traffic.
Track authentication events for administrator accounts and alert on logins from unusual source addresses or user agents.
Baseline normal traffic volume to /index/controller/Search.php and alert on bursts indicative of automated injection scanning.

How to Mitigate CVE-2026-36962

Immediate Actions Required

Restrict public access to the MuuCMF search endpoint until a vendor patch is available.
Place the application behind a web application firewall with SQL injection signatures enabled in blocking mode.
Audit MuuCMF databases for unauthorized administrator accounts, modified content, and unexpected files in web-writable directories.
Rotate all administrator credentials and database service account passwords if compromise is suspected.

Patch Information

No official vendor patch is referenced in the enriched CVE data at the time of publication. Monitor the MuuCMF Gitee repository for upstream fixes and apply updates as soon as they are released.

Workarounds

Apply input validation at a reverse proxy to reject keyword values containing SQL metacharacters such as quotes, semicolons, and comment sequences.
Restrict the database account used by MuuCMF to read-only privileges and revoke FILE privileges to block INTO OUTFILE abuse.
Set the web server document root and upload directories to non-writable for the database process user.
Disable or remove the search functionality if it is not required for business operations.

bash

# Example MySQL hardening to block INTO OUTFILE webshell writes
REVOKE FILE ON *.* FROM 'muucmf_user'@'%';
SET GLOBAL secure_file_priv = '/var/empty';
FLUSH PRIVILEGES;