Description

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T15:17:18.133Z",
  "pubdate": "2026-11-06T15:17:18.133Z",
  "executiveSummary": "Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are susceptible to an unauthenticated SQL injection vulnerability residing within the element search endpoint.\nThe vulnerability stems from improper sanitization of the 'attribute' parameter before it is concatenated into database queries.\nBecause the application environment utilizes emulated PDO prepares, the configuration facilitates the execution of stacked queries.\nAn unauthenticated remote attacker can leverage this flaw to perform arbitrary read and write operations against the backend database.\nSuccessful exploitation allows for critical security compromises, including the elevation of privileges by modifying user flags or overwriting password hashes in the 'users' table to obtain administrative access.\nThis represents a high-risk vulnerability due to the ease of reachability and the potential for full system compromise without requiring prior authentication.",
  "technicalDetails": "The root cause of this vulnerability is an input validation failure within the Craft CMS element search endpoint, specifically involving the 'attribute' parameter.\nDuring the processing of search requests, the application fails to properly sanitize or parameterize the user-supplied input before incorporating it directly into dynamic SQL queries.\nThe underlying database abstraction layer utilizes emulated PDO prepares by default in this configuration, which does not inherently prevent multi-statement execution if the database driver supports it.\nConsequently, an attacker can supply a malicious payload through the 'attribute' parameter to break out of the intended query context and append additional SQL statements, a technique known as stacked querying.\nThe attack flow proceeds as follows: 1) The attacker identifies the element search endpoint as the target vector. 2) The attacker crafts a request containing an 'attribute' parameter populated with a malicious SQL payload designed to alter the state of the database. 3) The application server receives the request and, due to the lack of sanitization, executes the injected SQL commands alongside the original query. 4) The database engine processes the concatenated instructions, effectively allowing the attacker to interact with tables outside the scope of the original search operation.\nThe impact of a successful exploitation is severe. By injecting commands that target the 'users' table, an attacker can modify account attributes. Specifically, an attacker may flip an 'admin' boolean flag for an arbitrary account or overwrite the existing password hash with a known value, thereby facilitating unauthorized administrative access to the Craft CMS control panel.\nThis vulnerability is classified as critical because it is reachable over the network without any requirement for authentication or special privileges. The combination of insecure concatenation and the support for stacked statements provides the attacker with a functional interface to manipulate the data layer entirely, bypassing standard access controls and authentication mechanisms implemented by the CMS."
}