CVE-2026-38468: GazellePW SQL Injection Vulnerability

CVE-2026-38468 Overview

CVE-2026-38468 is a SQL injection vulnerability in GazellePW (GazellePosterWall), an open-source private tracker platform. The flaw resides in the country-code lookup endpoint at tools.php?action=get_cc in commit 86c4bedf727691b5a97af42a4864869d18446449. Authenticated users holding the users_view_ips privilege can inject arbitrary SQL through the ip parameter. Successful exploitation exposes database contents and can lead to complete compromise of the tracker's backend data store.

Critical Impact
Authenticated attackers with the users_view_ips privilege can execute arbitrary SQL commands against the GazellePW database, enabling extraction of user credentials, IP records, and other sensitive tracker data.

Affected Products

GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
The classes/tools.class.php component handling country-code lookups
The sections/tools/services/get_cc.php endpoint

Discovery Timeline

2026-08-25 - CVE-2026-38468 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38468

Vulnerability Analysis

The vulnerability arises in the country-code lookup handler used by GazellePW's staff tools. The endpoint accepts an ip parameter and passes it into a SQL query without proper parameterization or sanitization. Because the user-supplied value is concatenated directly into the query string, an attacker can break out of the intended context and append arbitrary SQL clauses.

Exploitation requires an authenticated session with the users_view_ips privilege, which is typically limited to staff roles. However, according to the referenced exploit chain writeup, this endpoint can be combined with other flaws to escalate access. The impact includes reading arbitrary tables, exfiltrating password hashes, and modifying tracker state depending on the underlying database user's permissions.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The get_cc service dispatches the ip value into the query builder in classes/tools.class.php without prepared statements or strict input validation. See the GazellePW Tools Class source and the Get CC script for the vulnerable code paths.

Attack Vector

An attacker authenticates to the GazellePW instance with an account that holds users_view_ips. The attacker then issues a crafted HTTP request to tools.php?action=get_cc with a malicious payload in the ip parameter. The injected SQL executes with the privileges of the database user configured for GazellePW. The Snaacky exploit chain writeup documents how this endpoint contributes to a full database compromise.

No verified proof-of-concept code is reproduced here. See the referenced exploit chain writeup for technical exploitation details.

Detection Methods for CVE-2026-38468

Indicators of Compromise

Requests to tools.php?action=get_cc containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #, /*) in the ip parameter
Unexpected access to tools.php?action=get_cc from accounts that recently gained the users_view_ips privilege
Database error entries or long-running queries originating from the GazellePW web user
Outbound data transfers from the web tier following successful requests to the country-code endpoint

Detection Strategies

Review web server access logs for action=get_cc requests where the ip parameter is not a valid IPv4 or IPv6 literal
Enable MySQL general query logging on staging or forensic replicas to correlate suspect HTTP requests with resulting SQL statements
Deploy a web application firewall rule that flags SQL keywords and boolean-based injection patterns in the ip parameter

Monitoring Recommendations

Audit privileged accounts holding users_view_ips and alert on privilege grants or role changes
Monitor for anomalous volumes of requests to /tools.php from a single session or IP
Track database error rates and slow query counts tied to the GazellePW application user

How to Mitigate CVE-2026-38468

Immediate Actions Required

Restrict access to the tools.php?action=get_cc endpoint at the reverse proxy or web server layer until a patch is deployed
Revoke the users_view_ips privilege from accounts that do not require it for daily operations
Rotate database credentials and session secrets if logs show suspicious injection attempts
Force password resets for privileged tracker accounts and review recent staff activity

Patch Information

No upstream vendor patch was referenced at the time of NVD publication. Operators should track the GazellePW repository for commits addressing classes/tools.class.php and sections/tools/services/get_cc.php, and apply a fix that replaces string concatenation with parameterized queries.

Workarounds

Add server-side validation that rejects any ip parameter that does not match a strict IPv4 or IPv6 regular expression before it reaches PHP
Deploy a WAF rule blocking SQL keywords in the ip query parameter for /tools.php
Temporarily disable the country-code lookup feature by removing or renaming sections/tools/services/get_cc.php
Constrain the database account used by GazellePW to read-only access on non-essential tables

bash

# Example nginx rule to block obvious SQLi patterns on the vulnerable endpoint
location = /tools.php {
    if ($arg_action = "get_cc") {
        if ($arg_ip !~ "^[0-9a-fA-F:.]{1,45}$") {
            return 400;
        }
    }
}