CVE-2026-93484: Znuny Ticket Search SQL Injection Vulnerability

CVE-2026-93484 Overview

CVE-2026-93484 is a SQL injection vulnerability [CWE-89] affecting Znuny through version 7.3.6. The flaw resides in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB, where the ContentSearch parameter is concatenated directly into a SQL query without validation. The parameter is expected to contain only AND or OR, but Znuny does not enforce this constraint. An authenticated attacker with low privileges can inject arbitrary SQL statements through the ticket-search function, exposing or modifying ticket data stored in the backend database.

Critical Impact
Authenticated attackers can execute arbitrary SQL commands against the Znuny database, enabling data theft, unauthorized modification of ticket records, and denial of service.

Affected Products

Znuny versions up to and including 7.3.6
Kernel::System::Ticket::TicketSearch module
Kernel::System::Ticket::ArticleSearchIndex::DB module

Discovery Timeline

2026-10-15 - CVE-2026-93484 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-93484

Vulnerability Analysis

Znuny is an open-source service management and ticketing platform forked from OTRS. The ticket-search subsystem accepts a ContentSearch parameter that controls how multiple search terms are combined in the generated SQL query. The expected values are the literal strings AND or OR, which determine the Boolean operator between predicates.

Instead of validating this value against an allow-list or binding it as a parameter, Znuny concatenates the raw user input into the SQL statement produced by Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB. An attacker who can submit ticket-search requests can therefore break out of the operator context and append arbitrary SQL fragments.

Successful exploitation allows reading data from any table the Znuny database user can access, modifying ticket content, or triggering resource-intensive queries that degrade service availability. Because the vulnerable code paths are reachable through the standard authenticated agent and customer interfaces, exploitation requires only valid low-privileged credentials.

Root Cause

The root cause is unsafe string concatenation of user-controlled input into a dynamically constructed SQL statement. Znuny neither restricts the ContentSearch parameter to its two valid values nor uses parameterized placeholders, violating the standard defense against injection documented in [CWE-89].

Attack Vector

An authenticated attacker submits a crafted ticket-search request with a malicious ContentSearch value. The injected SQL is executed with the privileges of the Znuny database account. See the Znuny Advisory ZSA-2026-15 for the technical description from the vendor.

No verified proof-of-concept code is available at the time of publication. The vulnerability is described in prose only in the Znuny Security Advisories.

Detection Methods for CVE-2026-93484

Indicators of Compromise

Ticket-search requests where the ContentSearch parameter contains values other than the literal strings AND or OR.
Database errors or unusually long query execution times originating from Znuny ticket-search endpoints.
Unexpected UNION, SELECT, INSERT, UPDATE, or DROP tokens in web server access logs targeting Znuny endpoints.
Outbound data transfers from the Znuny application server following suspicious search queries.

Detection Strategies

Enable database query logging and alert on statements containing concatenated ContentSearch values that do not match an allow-list.
Deploy a web application firewall rule that inspects the ContentSearch parameter and blocks any value other than AND or OR.
Correlate authenticated session identifiers with abnormal ticket-search patterns to identify malicious accounts.

Monitoring Recommendations

Forward Znuny application and database logs to a centralized analytics platform for query-pattern analysis.
Baseline normal ticket-search volume per account and alert on sudden spikes or high-entropy parameter values.
Monitor Znuny database service accounts for unexpected read access to non-ticket tables.

How to Mitigate CVE-2026-93484

Immediate Actions Required

Upgrade Znuny to a version later than 7.3.6 that contains the fix referenced in advisory ZSA-2026-15.
Restrict agent and customer account creation to trusted users until patching is complete.
Review database audit logs for suspicious queries executed since the Znuny instance was deployed.

Patch Information

Znuny has published advisory ZSA-2026-15 describing the fix. Administrators should consult the Znuny Advisory ZSA-2026-15 and the full Znuny Security Advisories index for the exact fixed version and upgrade procedure.

Workarounds

Place a reverse proxy or WAF in front of Znuny that rejects any ticket-search request whose ContentSearch parameter is not exactly AND or OR.
Reduce the privileges of the Znuny database user to the minimum tables and operations required, limiting the blast radius of injected queries.
Temporarily disable the ticket-search feature for untrusted roles if patching cannot be performed immediately.

bash

# Example WAF rule concept (ModSecurity) to allow-list ContentSearch values
SecRule ARGS:ContentSearch "!@rx ^(AND|OR)$" \
    "id:1026934,phase:2,deny,status:400,log,\
     msg:'Znuny CVE-2026-93484: invalid ContentSearch value'"