Description

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-03T19:17:30.403Z",
  "pubdate": "2026-09-03T19:17:30.403Z",
  "executiveSummary": "Worklenz versions up to 3.0.0 contain a critical SQL injection vulnerability within its pagination helper functions. The flaw stems from improper sanitization of the 'sort-field' query parameter, which is concatenated directly into PostgreSQL ORDER BY clauses. This vulnerability allows authenticated users to execute arbitrary SQL commands, facilitating unauthorized data extraction.\nThe risk is severe, as it enables blind SQL injection—utilizing both time-based and boolean-based inference techniques—to exfiltrate sensitive data, including tenant password hashes and cross-tenant information. This vulnerability is classified as an incomplete fix for CVE-2026-25947, indicating that previous remediation efforts failed to address the underlying input validation deficiency.\nSuccessful exploitation requires authenticated access to the application. Given the potential for complete data compromise and cross-tenant data leakage, the impact on confidentiality is high. Organizations utilizing Worklenz 3.0.0 or earlier are at significant risk of database compromise and should prioritize mitigation to prevent unauthorized access to backend PostgreSQL resources.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the application's data abstraction layer to validate or parameterize user-supplied input used in dynamic query generation. Specifically, the 'sort-field' query parameter is processed by pagination helper functions without being constrained to an allow-list of legitimate column identifiers. Consequently, an attacker can manipulate the HTTP request to inject malicious SQL syntax into the ORDER BY clause of a generated PostgreSQL query.\nThe vulnerability manifests as a SQL injection flaw where the backend database interpreter fails to distinguish between developer-intended column references and attacker-supplied instructions. Because the ORDER BY clause in PostgreSQL permits complex expressions, including subqueries and conditional logic, the surface area for exploitation is extensive. Attackers can leverage this by crafting inputs that force the database to execute specific logic based on conditional testing.\nThe exploitation flow typically involves an authenticated user crafting a malicious request by appending crafted SQL payloads to the 'sort-field' parameter. Using boolean-based blind injection, the attacker can submit payloads such as 'sort-field=(CASE WHEN (SELECT SUBSTR(password,1,1) FROM users WHERE id=1)='a' THEN id ELSE name END)'. By observing changes in the server's response or result sorting, the attacker can infer the character content of sensitive database fields bit by bit. Additionally, time-based techniques can be employed by injecting sleep-inducing functions—such as pg_sleep()—conditioned on specific query results, allowing for precise data exfiltration even if the application response does not explicitly reflect the injected values.\nThis vulnerability is particularly dangerous due to its capacity for cross-tenant data access. By bypassing the intended scoping of the pagination queries, an attacker can alter the query structure to target tables or rows belonging to other tenants, effectively violating logical data isolation. The fact that this is an incomplete fix for CVE-2026-25947 suggests that initial efforts to sanitize inputs were likely restricted to specific characters or keywords that could be bypassed via advanced SQL syntax or encoding techniques available to an attacker. This flaw persists in all versions up to 3.0.0, necessitating comprehensive input validation strategies rather than simple blacklisting or partial sanitization."
}