CVE-2026-36989: LuxSoft LuxCal SQL Injection Vulnerability

CVE-2026-36989 Overview

CVE-2026-36989 is a SQL Injection vulnerability [CWE-89] affecting LuxSoft LuxCal web calendar through version 5.3.4L. The flaw resides in rssfeed.php and common/retrieve.php, where user-supplied input reaches SQL queries without proper sanitization. Remote attackers can send crafted HTTP requests to manipulate database queries without authentication or user interaction. Public proof-of-concept code is available, lowering the barrier to exploitation. The vulnerability primarily enables information disclosure from the underlying database.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through rssfeed.php and common/retrieve.php, exposing calendar data and potentially other information stored in the backing database.

Affected Products

LuxSoft LuxCal through version 5.3.4L
rssfeed.php endpoint
common/retrieve.php endpoint

Discovery Timeline

2026-09-13 - CVE-2026-36989 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-36989

Vulnerability Analysis

LuxCal is a PHP-based web calendar application from LuxSoft. The affected endpoints rssfeed.php and common/retrieve.php accept request parameters that flow directly into SQL statements. Because input is not parameterized or escaped, attackers can break out of the intended query context. The result is classic SQL Injection reachable over the network without credentials.

The scope-changed rating in the CVSS metrics indicates that a successful exploit can affect data beyond the vulnerable component itself, such as other tables or databases sharing the same connection. Confidentiality impact is the primary concern, while integrity and availability are not directly affected by the base vector.

Root Cause

The root cause is missing input validation and lack of prepared statements in the two vulnerable PHP files. User-controlled request parameters are concatenated into SQL query strings, allowing attacker-supplied fragments to alter query semantics. This is a textbook instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An attacker sends an HTTP request to rssfeed.php or common/retrieve.php with a crafted parameter value containing SQL syntax. The injected payload can enumerate database schema, extract records via UNION-based or boolean-based techniques, or use time-based blind extraction. No authentication is required, and the attack is executable from any network position with reachability to the web server. Refer to the GitHub Gist proof-of-concept and the Mathys analysis of CVE-2026-36989 for exploitation details.

Detection Methods for CVE-2026-36989

Indicators of Compromise

HTTP requests to rssfeed.php or common/retrieve.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment markers like -- and /*.
Unusual query parameter values with encoded quotes (%27, %22) or boolean tautologies such as 1=1.
Web server logs showing repeated requests to the same endpoint with incrementally changing payloads, consistent with automated SQLi tooling.

Detection Strategies

Deploy web application firewall (WAF) rules that match SQL injection patterns targeting the affected PHP endpoints.
Enable database query logging and alert on anomalous query shapes originating from the LuxCal application user.
Correlate web access logs with database error responses (HTTP 500) to surface probing activity.

Monitoring Recommendations

Baseline normal parameter values for rssfeed.php and common/retrieve.php, then alert on deviations.
Monitor outbound data volumes from the database server for signs of mass extraction.
Track user agents associated with SQL injection scanners such as sqlmap in HTTP access logs.

How to Mitigate CVE-2026-36989

Immediate Actions Required

Restrict network access to the LuxCal instance until a patched version is deployed.
Place the application behind a WAF configured with SQL injection signatures for the affected endpoints.
Review web and database logs for prior exploitation attempts against rssfeed.php and common/retrieve.php.

Patch Information

No vendor advisory URL is listed in the NVD entry at publication time. Administrators should monitor the LuxSoft LuxCal project site for a release beyond 5.3.4L that addresses the vulnerability, and apply it as soon as it becomes available.

Workarounds

Block or restrict access to rssfeed.php and common/retrieve.php at the web server or reverse proxy layer if these endpoints are not required.
Enforce least-privilege permissions on the database account used by LuxCal, limiting it to only the tables required for calendar operations.
Deploy input validation at the reverse proxy to reject request parameters containing SQL metacharacters.

bash

# Example nginx configuration to block requests with common SQLi patterns
location ~ ^/(rssfeed\.php|common/retrieve\.php)$ {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|--|/\*)") {
        return 403;
    }
    # proxy_pass or fastcgi_pass to LuxCal backend
}