CVE-2026-96600 Overview
CVE-2026-96600 is a blind SQL injection vulnerability affecting Isotope eCommerce through version 2.9.10, an e-commerce extension for the Contao CMS. The flaw resides in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements without parameterization. Authenticated Contao backend users holding Isotope module permissions can issue conditional and time-based injection payloads to extract arbitrary database contents. Attackers commonly target the tl_user table to retrieve administrator password hashes for offline cracking and lateral movement.
Critical Impact
Authenticated backend users can exfiltrate arbitrary database records, including administrator credential hashes, enabling full compromise of the Contao installation.
Affected Products
- Isotope eCommerce versions up to and including 2.9.10
- Contao CMS installations with the Isotope module enabled
- Backend user accounts granted Isotope attribute, product price, or media manager permissions
Discovery Timeline
- 2026-09-23 - CVE-2026-96600 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-96600
Vulnerability Analysis
The vulnerability is a classic SQL injection [CWE-89] in server-side PHP callback handlers used by the Isotope backend. Multiple callback functions concatenate untrusted values into SQL query strings rather than binding them as parameters. Because the queries execute under the database credentials of the Contao application, an attacker can pivot from a low-privilege backend account with Isotope permissions to reading any table the application user can access.
Exploitation is blind, meaning the injected query does not return content directly in the HTTP response. Instead, attackers use boolean-conditional payloads or time-delay primitives such as SLEEP() to infer data byte by byte. The tl_user table is a high-value target because it stores hashed credentials for all Contao backend administrators.
Root Cause
The affected callbacks in system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php, system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php, and system/modules/isotope/library/Isotope/Widget/MediaManager.php build SQL statements through string interpolation. Request-controlled identifiers and administrator-supplied values are inserted into query text without whitelisting, escaping, or prepared statement bindings. See the VulnCheck Isotope SQL Injection Advisory and GitHub Isotope Issue #2585 for the referenced source locations.
Attack Vector
An attacker must first authenticate to the Contao backend and hold Isotope module permissions. The attacker then submits crafted values through backend forms or requests that reach the vulnerable callbacks. Time-based payloads produce measurable response delays when a condition is true, while boolean-based payloads alter application behavior. Iterating these payloads reconstructs sensitive data such as password hashes from tl_user.
No verified public exploit is available at time of publication. Refer to the GitHub Isotope Core Repository for the affected code paths.
Detection Methods for CVE-2026-96600
Indicators of Compromise
- Backend HTTP requests to Isotope attribute, product price, or media manager endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT
- Anomalous response latency patterns clustered around Isotope backend routes, indicating time-based blind injection probing
- Database queries referencing tl_user originating from Isotope callback contexts where such reads are not expected
- Backend session activity from Isotope-permissioned accounts issuing high volumes of near-identical requests with small payload variations
Detection Strategies
- Enable MySQL general query logging or the slow query log and alert on queries from the Contao application user that reference tl_user outside of authentication flows
- Inspect web server access logs for repeated requests to /contao routes tied to Isotope callbacks with encoded SQL metacharacters in parameter values
- Correlate spikes in 200-OK responses with abnormal response-time distributions on Isotope backend endpoints
Monitoring Recommendations
- Forward Contao and web server logs to a centralized analytics platform for retrospective hunting across Isotope endpoints
- Baseline normal backend user behavior and alert on deviations in request volume, parameter entropy, or query timing
- Monitor tl_user table access frequency and generate alerts when read patterns exceed established thresholds
How to Mitigate CVE-2026-96600
Immediate Actions Required
- Restrict Isotope backend module permissions to trusted administrators only and audit existing role assignments
- Rotate all Contao backend user passwords, particularly for accounts stored in tl_user, and invalidate active backend sessions
- Place the Contao backend behind network controls such as VPN or IP allowlisting to limit exposure of authenticated attack surface
- Review web server and database logs for prior indicators of blind SQL injection attempts against Isotope callback endpoints
Patch Information
At the time of publication, the enriched CVE data does not reference a fixed release. Monitor the GitHub Isotope Core Repository and GitHub Isotope Issue #2585 for an official patched version above 2.9.10. Apply the vendor update as soon as it becomes available and validate that the affected callbacks use parameterized queries.
Workarounds
- Temporarily revoke Isotope module permissions from non-essential backend users until a patched release is deployed
- Deploy a web application firewall rule set that blocks SQL metacharacters and time-delay functions in parameters sent to Isotope backend routes
- Enforce least-privilege on the database account used by Contao so that Isotope cannot read tables it does not require, reducing the blast radius of a successful injection
- Enable multi-factor authentication for all Contao backend accounts to raise the cost of credential-based access to the vulnerable surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.