CVE-2026-38467 Overview
CVE-2026-38467 is a SQL injection vulnerability in the tags manager component of GazellePW (GazellePosterWall), an open-source private tracker platform. The flaw exists in commit 86c4bedf727691b5a97af42a4864869d18446449 and affects the manage_tags.php endpoint. Authenticated users with users_mod privileges can inject arbitrary SQL through the tagid or type parameters in a crafted POST request to tools.php?action=manage_tags. Successful exploitation exposes the underlying database, enabling data theft, tampering, or full backend compromise.
Critical Impact
Authenticated staff-level attackers can execute arbitrary SQL statements against the GazellePW database, leading to credential theft, data exfiltration, and potential full database compromise.
Affected Products
- GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
- sections/tools/managers/manage_tags.php handler
- Deployments exposing tools.php?action=manage_tags to users_mod staff accounts
Discovery Timeline
- 2026-08-25 - CVE-2026-38467 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-38467
Vulnerability Analysis
The tags manager accepts the tagid and type POST parameters and concatenates them into SQL statements without parameterization or sanitization. Because manage_tags.php executes queries against the primary tracker database, injected SQL runs with the privileges of the application database user. This maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
An attacker holding a session with the users_mod permission bit can issue crafted POST requests to tools.php?action=manage_tags and manipulate query structure. Public exploit chain analysis demonstrates pivoting this primitive into a full database read, including administrative password hashes and session tokens. The EPSS estimate places near-term exploitation probability low, but a working chain is documented publicly.
Root Cause
The root cause is unsafe SQL construction inside the manage_tags handler. Values received from the tagid and type request parameters are inserted directly into query strings rather than passed through prepared statements or the framework's escaping helpers. The privilege gate on users_mod was treated as sufficient trust, so no server-side validation is performed on parameter type, length, or character set.
Attack Vector
Exploitation requires an authenticated session with the users_mod staff role. The attacker submits a POST request to tools.php?action=manage_tags with a malicious payload in either the tagid or type field. The injected SQL executes inline and, depending on payload construction, supports UNION-based extraction, boolean-based inference, or time-based blind techniques.
See the GitHub PoC Repository for the vulnerable source and the Snaacky Exploit Chain Analysis for a documented one-click chain that combines this flaw with adjacent issues to reach full database compromise.
Detection Methods for CVE-2026-38467
Indicators of Compromise
- POST requests to tools.php?action=manage_tags containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences in the tagid or type parameters.
- Web server access logs showing unusually long or repeated POSTs to the manage_tags action from a single staff account.
- Database error entries referencing the tags manager query context or unexpected SELECT activity against users_main or session tables.
- Newly created or modified staff accounts following access to manage_tags by a users_mod user.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect POST bodies to tools.php?action=manage_tags for SQL injection signatures on tagid and type.
- Correlate authenticated session identifiers with anomalous request volume or payload size against the tags manager endpoint.
- Enable MySQL/MariaDB general or audit logging to flag queries originating from the tags manager that reference sensitive tables.
Monitoring Recommendations
- Alert on any HTTP 500 responses from tools.php?action=manage_tags, which frequently indicate injection probing.
- Track users_mod account activity, including login origin, session duration, and endpoints accessed.
- Baseline normal query patterns for the tracker database and alert on deviations such as information_schema reads.
How to Mitigate CVE-2026-38467
Immediate Actions Required
- Restrict access to tools.php?action=manage_tags at the reverse proxy or WAF layer until code fixes are in place.
- Audit all accounts holding the users_mod permission bit and revoke the privilege from any non-essential users.
- Rotate database credentials, application secrets, and staff passwords if exploitation is suspected.
- Review audit logs and database query logs for prior exploitation attempts against the vulnerable endpoint.
Patch Information
No official vendor patch is referenced in the CVE record. Operators running GazellePW at or near commit 86c4bedf727691b5a97af42a4864869d18446449 should rebase onto the current upstream main branch and verify that sections/tools/managers/manage_tags.php uses parameterized queries for tagid and type. Monitor the GazellePW repository for follow-up commits.
Workarounds
- Apply an inline patch that casts tagid to an integer and validates type against an allowlist before use in any query.
- Replace direct string interpolation in manage_tags.php with the framework's prepared statement helpers.
- Temporarily disable the tags manager feature by removing or gating the action=manage_tags route in tools.php.
- Enforce IP allowlisting for staff-only administrative paths so that users_mod sessions cannot originate from the public internet.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
