CVE-2026-37505: V2Board SQL Injection Vulnerability

CVE-2026-37505 Overview

CVE-2026-37505 is a SQL injection vulnerability in V2Board through version 1.7.4. The flaw resides in app/Http/Controllers/Admin/UserController.php, where the sort parameter from user input flows directly into User::orderBy($sort, $sortType) without validation. An authenticated administrator can sort users by any database column, including password and remember_token. The ordering behavior leaks information about sensitive column values, enabling row-by-row inference of credential material. The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated administrators can infer the contents of sensitive columns such as password hashes and session tokens by abusing the unvalidated ORDER BY clause.

Affected Products

• V2Board through version 1.7.4
• The vulnerable endpoint is exposed via app/Http/Controllers/Admin/UserController.php
• Deployments using the default admin user listing functionality

Discovery Timeline

• 2026-05-01 - CVE-2026-37505 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-37505

Vulnerability Analysis

The vulnerability is an ORDER BY injection in V2Board's administrative user listing controller. V2Board uses Laravel's Eloquent ORM, and the controller passes the user-supplied sort parameter directly to User::orderBy($sort, $sortType). Eloquent does not parameterize column identifiers, so the sort value is concatenated into the generated SQL ORDER BY clause.

Because administrators control the column used for ordering, they can specify any column on the users table, including password, remember_token, email, and other sensitive fields. Sorting on these columns reveals their relative ordering across rows, which an attacker can convert into character-level disclosure through repeated requests and binary search style techniques. The vulnerability requires authenticated administrator privileges, but compromised or rogue admin accounts can extract credential material that is otherwise stored as hashes.

Root Cause

The root cause is missing allowlist validation on the sort request parameter before it reaches the ORM. The controller does not constrain sort to a fixed set of safe columns such as id, created_at, or email. Any string accepted by Eloquent's orderBy is passed through to the database, breaking the principle of treating identifiers as untrusted input.

Attack Vector

Exploitation requires network access to the admin panel and valid administrator credentials. The attacker issues repeated requests to the user listing endpoint with the sort parameter set to a sensitive column and observes the resulting row order. By combining ordering observations with filters or pagination, the attacker reconstructs values stored in target columns. Refer to the published GitHub Gist proof-of-concept script and the V2Board project repository for technical details. No exploitation code is reproduced here.

Detection Methods for CVE-2026-37505

Indicators of Compromise

• Repeated admin requests to the user listing endpoint with varying sort parameter values referencing sensitive columns such as password or remember_token.
• Bursts of paginated admin queries from a single session within short time windows, consistent with automated ordering oracle scripts.
• Admin sessions issuing sort values that do not match any column exposed by the legitimate UI.

Detection Strategies

• Inspect web server and application logs for sort=password, sort=remember_token, or other unexpected column names in admin URLs.
• Enable Laravel query logging in non-production tiers to capture ORDER BY clauses that reference sensitive columns.
• Correlate high-volume admin list requests with low result-set diversity, which is typical of inference-based extraction.

Monitoring Recommendations

• Alert when the same admin account issues more than a small threshold of user listing requests per minute.
• Forward web access logs and database audit logs to a central data lake to enable cross-source correlation.
• Review admin account activity baselines and flag deviations in endpoint usage patterns.

How to Mitigate CVE-2026-37505

Immediate Actions Required

• Restrict access to the V2Board admin panel using network controls, VPN, or IP allowlisting until a fix is applied.
• Audit administrator accounts and rotate credentials and remember_token values for any account that may have been abused.
• Apply an allowlist on the sort parameter in app/Http/Controllers/Admin/UserController.php to permit only known safe columns.

Patch Information

No official vendor advisory URL is listed in the NVD entry at the time of publication. Monitor the V2Board GitHub repository for releases addressing this issue and upgrade beyond version 1.7.4 once a fixed release is available.

Workarounds

• Implement an explicit allowlist that maps user-supplied sort values to a fixed set of safe column identifiers before calling orderBy.
• Reject requests where sort does not match the allowlist and log the event for review.
• Reduce the blast radius by limiting which administrator roles can access the affected user listing endpoint.

# Configuration example: allowlist enforcement pattern in the controller
# Replace direct use of $request->input('sort') with a validated value
# $allowed = ['id', 'email', 'created_at'];
# $sort = in_array($request->input('sort'), $allowed, true) ? $request->input('sort') : 'id';
# $sortType = $request->input('sort_type') === 'asc' ? 'asc' : 'desc';
# User::orderBy($sort, $sortType)