CVE-2026-72550 Overview
CVE-2026-72550 is an unauthenticated SQL injection vulnerability in Friendica, a decentralized social networking platform. The flaw exists in the photo-view component through the 2026.08-dev branch. The order parameter is concatenated unescaped into a SHOW COLUMNS query executed via a bare PDO::query() call. This construction enables stacked statement injection, allowing attackers to append arbitrary SQL statements. Remote unauthenticated attackers can read, modify, or delete the entire database. The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL statements, resulting in full database compromise including data exfiltration, tampering, and destruction.
Affected Products
- Friendica social networking platform
- Versions through the 2026.08-dev development branch
- Deployments exposing the photo-view endpoint to unauthenticated users
Discovery Timeline
- 2026-08-11 - CVE-2026-72550 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72550
Vulnerability Analysis
The vulnerability resides in Friendica's photo-view handler, which accepts an order parameter from HTTP requests. The application passes this parameter directly into a SHOW COLUMNS SQL query without sanitization or parameterization. Because the query executes through a bare PDO::query() call rather than a prepared statement, attackers can terminate the initial statement and append additional SQL commands. PDO's default configuration in this context permits stacked queries, expanding the attack surface beyond a single read operation.
An unauthenticated attacker can leverage stacked statements to perform INSERT, UPDATE, DELETE, or DROP operations against any table in the Friendica database. This includes user credentials, private messages, contact relationships, and photo metadata. Because Friendica underpins federated social communities, a compromised instance also risks propagating malicious content across connected nodes.
Root Cause
The root cause is unsafe string concatenation of user-controlled input into a dynamic SQL query. SHOW COLUMNS cannot use parameter binding for identifier positions, which likely led developers to skip prepared-statement handling. The absence of an allowlist for permissible order values, combined with PDO::query() allowing multi-statement execution, produces the injection primitive.
Attack Vector
Exploitation requires only network access to a Friendica instance. The attacker submits a crafted HTTP request to the photo-view endpoint with a malicious order parameter containing a statement terminator followed by arbitrary SQL. No authentication, user interaction, or elevated privileges are required. Detailed technical context is available in the GitHub Friendica Repository.
Detection Methods for CVE-2026-72550
Indicators of Compromise
- HTTP requests to photo-view URLs containing SQL metacharacters such as ;, --, UNION, or SLEEP in the order parameter
- Database logs showing unexpected SHOW COLUMNS queries followed by data-modifying statements
- Web server access logs with unusually long or URL-encoded order parameter values
- Creation of new administrative accounts or unexpected changes to the user table
Detection Strategies
- Inspect web application firewall logs for SQL injection payloads targeting the order parameter on Friendica endpoints
- Correlate PDO::query() execution traces with request patterns that include statement terminators
- Monitor database audit logs for stacked statement execution originating from the Friendica application user
Monitoring Recommendations
- Enable MySQL or MariaDB general query logging on Friendica database backends during incident triage
- Alert on schema modification events (CREATE, DROP, ALTER) initiated by the web application account
- Track outbound network connections from the database host that could indicate data exfiltration
How to Mitigate CVE-2026-72550
Immediate Actions Required
- Restrict public access to Friendica photo-view endpoints until a patched release is deployed
- Deploy web application firewall rules that block SQL metacharacters in the order parameter
- Rotate database credentials and administrative account passwords if exploitation is suspected
- Review database audit logs for unauthorized INSERT, UPDATE, DELETE, or DROP activity
Patch Information
At the time of publication, no vendor patch reference is included in the NVD entry. Administrators should monitor the GitHub Friendica Repository for commits addressing the photo-view order parameter handling and upgrade as soon as a fixed release is available.
Workarounds
- Enforce an allowlist of acceptable order parameter values at a reverse proxy or WAF layer
- Disable multi-statement execution on the database connection used by Friendica where feasible
- Restrict the database user account to the minimum privileges required, removing schema modification rights
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
