Description

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T15:17:18.313Z",
  "pubdate": "2026-11-06T15:17:18.313Z",
  "executiveSummary": "Craft CMS 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are susceptible to a critical blind SQL injection vulnerability.\nThe flaw originates from improper input sanitization within the sandbox-exposed getNext() and getPrev() methods.\nBy manipulating criteria arrays to include SQL-sensitive properties such as orderBy or where, an authenticated attacker with access to the control panel can execute arbitrary conditional queries.\nThis creates a side-channel oracle, allowing the attacker to infer database content bit-by-bit.\nSuccessful exploitation requires authenticated access to the control panel, where the attacker must inject a crafted elementIds value into a sandboxed template.\nThe impact is significant, potentially leading to unauthorized data exfiltration, exposure of sensitive configuration details, or internal database structure reconnaissance.\nThe vulnerability highlights a failure in the application's secure coding practices regarding the handling of dynamic query configuration objects, allowing user-supplied input to influence database query construction directly.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied criteria arrays passed to the Craft::configure() method via the getNext() and getPrev() functions. These functions are exposed to the template sandbox environment, intended to facilitate navigation between elements. However, they fail to strip dangerous properties from the provided criteria array.\nIn Craft CMS, these criteria arrays are eventually used to build query objects. Because the application logic does not restrict the properties of the arrays passed to these methods, an attacker can inject arbitrary key-value pairs that are subsequently interpreted by the database abstraction layer. Specifically, keys such as 'orderBy' or 'where' are processed by the query builder, allowing for the injection of raw SQL fragments into the generated query.\nThe attack flow requires an authenticated user with access to the control panel to supply a malicious input string formatted as an elementIds value. When this value is processed by a sandboxed template, it reaches the vulnerable getNext() or getPrev() method. The attacker crafts a payload that manipulates the underlying database query structure, for instance by appending a subquery or a conditional statement (e.g., CASE statements or boolean logic) to the query's WHERE or ORDER BY clauses.\nBy observing the application's response—such as variations in the returned elements, different sorting behavior, or successful/failed request outcomes—an attacker can implement a blind SQL injection oracle. This enables the attacker to systematically query the database and extract information stored within, including usernames, hashes, or other sensitive records accessible to the database user configured for Craft CMS.\nThis vulnerability is particularly dangerous because it bypasses standard application-level controls by operating at the database interaction layer. The exploit leverage the flexibility of the Craft CMS element query system, which is designed to be highly dynamic, to perform unauthorized actions. Since this functionality is part of the core template sandbox, it is accessible to any user capable of executing Twig code within the control panel environment, limiting the exploitability window to those with specific administrative or authoring privileges.\nThe affected versions include the entire 4.x branch prior to 4.18.9 and the entire 5.x branch prior to 5.11.2. The vulnerability demonstrates a critical failure in enforcing 'allow-lists' for query parameters, emphasizing the necessity of strict validation for inputs reaching deep architectural components."
}