CVE-2026-71292: Subrion CMS SQL Injection Vulnerability

CVE-2026-71292 Overview

CVE-2026-71292 is a SQL injection vulnerability [CWE-89] in Subrion CMS's admin grid sorting helper _gridGetSorting() located in includes/classes/ia.base.controller.admin.php. The function whitelists the dir parameter but falls back to the raw, attacker-supplied sort GET parameter when the key is not present in the per-controller $_gridSorting whitelist. Authenticated administrators can inject arbitrary SQL through the sort parameter across the majority of the ~29 admin grid controllers. Successful exploitation permits extraction of database contents, including administrator password hashes.

Critical Impact
An authenticated admin session can execute arbitrary SQL queries against the Subrion database, enabling full data exfiltration and integrity compromise across most admin grid endpoints.

Affected Products

Subrion CMS (all versions containing the vulnerable _gridGetSorting() implementation)
Admin grid controllers lacking a $_gridSorting whitelist (e.g. pages.php, transactions.php, languages.php)
Admin grid controllers with incomplete $_gridSorting whitelists (e.g. members.php)

Discovery Timeline

2026-08-05 - CVE-2026-71292 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71292

Vulnerability Analysis

The defect resides in _gridGetSorting() within includes/classes/ia.base.controller.admin.php. The method validates the dir request parameter against the values ASC and DESC using in_array(), which correctly restricts direction input. It does not, however, apply equivalent validation to the sort parameter. The code selects the column identifier with the expression $column = isset($this->_gridSorting[$params['sort']]) ? ... : $params['sort'];. When the requested key is absent from the controller's whitelist, the raw attacker-controlled value flows directly into sprintf(' ORDER BY %s%s %s', $tableAlias, $column, $direction). Only backtick quoting is applied, and no escaping occurs. A backtick placed inside the payload breaks out of the identifier context and allows SQL to be appended to the query.

Root Cause

The root cause is unsafe fallback behavior in a partial allow-list implementation. The developer contract assumed each admin controller would declare a complete $_gridSorting mapping, but most controllers either omit the mapping entirely or cover only a subset of their sortable columns. In every uncovered case, unsanitized user input is concatenated into a SQL ORDER BY clause.

Attack Vector

Exploitation requires an authenticated administrator session. The attacker issues a GET request to any admin grid endpoint with a crafted sort parameter containing a backtick, followed by an SQL payload. Both error-based extraction using EXTRACTVALUE and blind time-based extraction using SLEEP() are viable. The vast majority of admin grid endpoints are exploitable because they lack a complete $_gridSorting whitelist. The affected code path is visible in the Subrion Admin Controller source.

No verified public exploit code is available. Refer to the Subrion repository for the affected implementation.

Detection Methods for CVE-2026-71292

Indicators of Compromise

HTTP requests to admin grid endpoints containing backtick characters, SLEEP(, EXTRACTVALUE(, or UNION SELECT in the sort query parameter.
Unusually long database response times correlated with admin session requests, indicative of time-based SQL injection.
Web server access logs showing repeated variations of the sort parameter from a single admin session.

Detection Strategies

Deploy web application firewall rules that inspect the sort GET parameter on /admin/ routes for SQL metacharacters and function names.
Enable database query logging and alert on ORDER BY clauses containing subqueries, SLEEP, or XML functions such as EXTRACTVALUE.
Correlate authenticated admin session identifiers with anomalous query patterns to identify compromised accounts.

Monitoring Recommendations

Monitor administrator authentication events and geolocations to detect account takeover preceding exploitation.
Track query execution latency on the Subrion database and alert on statistical outliers.
Audit changes to administrator password hashes and the creation of new privileged accounts.

How to Mitigate CVE-2026-71292

Immediate Actions Required

Restrict access to the Subrion admin interface using network controls, VPN, or IP allow-listing until a patch is applied.
Rotate all administrator credentials and invalidate active admin sessions.
Review recent admin activity logs for evidence of sort parameter tampering.

Patch Information

No official patch is referenced in the NVD record at the time of publication. Consult the upstream Subrion repository for remediation status. Operators should apply the fix by defining a complete $_gridSorting whitelist in each admin controller and modifying _gridGetSorting() to reject any sort value not present in the whitelist rather than falling through to the raw input.

Workarounds

Add a strict server-side filter that rejects any sort parameter value containing non-alphanumeric characters before it reaches _gridGetSorting().
Populate $_gridSorting arrays in all admin controllers to cover every sortable column, eliminating the unsafe fallback path.
Deploy a WAF signature that blocks backticks and SQL keywords in the sort query parameter across all admin routes.

bash

# Example nginx rule to block suspicious sort parameters on admin routes
location ~ ^/admin/ {
    if ($arg_sort ~* "(\`|sleep\(|extractvalue\(|union\s+select|--|/\*)") {
        return 403;
    }
}