CVE-2026-96604: DataLife Engine 18.0 SQL Injection Vulnerability

CVE-2026-96604 Overview

CVE-2026-96604 is a SQL injection vulnerability in SoftNews Media Group DataLife Engine 18.0. The flaw resides in the strip_data function within engine/modules/search.php, part of the Search Module. Attackers can manipulate the story argument to inject arbitrary SQL statements against the backend database.

The vulnerability is remotely exploitable without authentication or user interaction. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. This vulnerability is tracked under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Unauthenticated remote attackers can inject SQL statements through the search parameter, potentially exposing database contents and enabling further compromise of the CMS backend.

Affected Products

SoftNews Media Group DataLife Engine 18.0
Component: Search Module (engine/modules/search.php)
Affected function: strip_data

Discovery Timeline

2026-09-23 - CVE-2026-96604 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96604

Vulnerability Analysis

The vulnerability exists in the strip_data function of engine/modules/search.php in DataLife Engine 18.0. The story request parameter is passed into a SQL query without sufficient sanitization or parameterization. An attacker can supply crafted input that breaks out of the intended query context and appends attacker-controlled SQL.

Because the Search Module is reachable over the network by anonymous users, exploitation requires only an HTTP request to the search endpoint with a manipulated story value. Successful injection can expose stored user records, session data, and configuration values held in the CMS database.

The issue is classified under CWE-74, covering improper neutralization of special elements in output used by a downstream component. The public disclosure and unresponsive vendor status increase the risk that opportunistic actors will weaponize the flaw against internet-facing DataLife Engine installations.

Root Cause

The strip_data sanitization routine fails to fully neutralize SQL metacharacters supplied through the story parameter. Input reaches the SQL layer as concatenated string data rather than through parameterized queries or bound statements, allowing injection of additional SQL clauses.

Attack Vector

Exploitation is performed remotely over the network. An attacker issues an HTTP request to the search endpoint of a DataLife Engine 18.0 instance with a malicious story parameter value. No credentials and no user interaction are required. Public exploit information is referenced through the Pastebin data leak and the VulDB entry for CVE-2026-96604.

No verified proof-of-concept code is republished here. Refer to the linked advisories for technical exploitation details.

Detection Methods for CVE-2026-96604

Indicators of Compromise

HTTP requests to search endpoints containing SQL metacharacters (', --, UNION, SELECT) in the story parameter
Unexpected database errors logged by the DataLife Engine application referencing the search module
Anomalous SELECT queries against user, session, or configuration tables originating from the web application process
Outbound connections from the web server to unfamiliar hosts following anomalous search traffic

Detection Strategies

Deploy web application firewall rules that inspect the story parameter on requests to engine/modules/search.php for SQL injection payloads
Enable database query logging and alert on unusual UNION SELECT or INFORMATION_SCHEMA access from the CMS database user
Correlate web server access logs with database error logs to identify probing activity against the Search Module

Monitoring Recommendations

Monitor request rates and response sizes for the search endpoint to identify enumeration and data exfiltration attempts
Track authentication failures and privilege changes on database accounts used by DataLife Engine
Baseline normal query patterns from the CMS and alert on deviations such as queries returning oversized result sets

How to Mitigate CVE-2026-96604

Immediate Actions Required

Restrict public access to engine/modules/search.php using WAF rules or reverse proxy filtering until a vendor patch is available
Enforce input validation at the perimeter to reject SQL metacharacters in the story parameter
Reduce database privileges granted to the DataLife Engine database account to the minimum required for CMS operation
Review web and database logs for prior exploitation attempts referenced in the VulDB advisory

Patch Information

As of publication, no vendor patch has been released. According to the disclosure, SoftNews Media Group did not respond to notification. Administrators should monitor the DataLife Engine vendor site for updates and apply any released security fix promptly.

Workarounds

Deploy virtual patching through a WAF to block SQL injection patterns targeting the story parameter
Disable or restrict the Search Module if it is not required for site functionality
Place the CMS behind authenticated access controls where feasible to reduce anonymous exposure
Isolate the database server on a segmented network with strict egress filtering

bash

# Example ModSecurity rule blocking SQLi patterns on the story parameter
SecRule ARGS:story "@rx (?i)(union(\s|/\*.*\*/)+select|select.+from|--|;|/\*|\bor\b\s+\d+=\d+)" \
    "id:1096604,phase:2,deny,status:403,log,msg:'CVE-2026-96604 DataLife Engine SQLi attempt'"