Description

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T05:17:00.537Z",
  "pubdate": "2026-09-15T05:17:00.537Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in zyx0814 FilePress versions up to 3.0.1 within the Publish Module.\nThe vulnerability is located in dzz/publish/search.php and allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'orderby' or 'order' parameters.\nSuccessful exploitation permits unauthorized access to the underlying database, potentially leading to data exfiltration, modification, or complete system compromise.\nThe flaw stems from insufficient input validation and improper neutralization of user-supplied data before it is utilized in database queries.\nGiven the availability of public exploits and the lack of vendor response, the risk of active exploitation is significant.\nDefensive actions must prioritize input sanitization and the implementation of parameterized queries to prevent the injection of malicious SQL syntax.",
  "technicalDetails": "The vulnerability resides within the dzz/publish/search.php script of the FilePress Publish Module. The application fails to adequately sanitize or parameterize the 'orderby' and 'order' HTTP GET/POST arguments before passing them into backend database queries.\nThis improper handling enables an attacker to perform SQL injection by appending malicious SQL syntax to the affected parameters. By manipulating these inputs, an attacker can escape the intended query structure, allowing for the concatenation of unauthorized commands such as UNION-based SQL injection, boolean-based blind injection, or time-based blind injection.\nThe attack flow initiates with a remote request directed at the vulnerable search.php endpoint. The attacker injects SQL tokens (e.g., single quotes, comment delimiters, or UNION SELECT statements) into the vulnerable parameter fields. Since the application does not utilize prepared statements or rigorous whitelist-based input validation for these ordering parameters, the database engine executes the injected malicious instructions alongside the legitimate query.\nThe scope of impact is highly critical, as it bypasses the application's authentication layer. Attackers can leverage this flaw to extract sensitive data from the database, such as administrator credentials, user metadata, or proprietary system information. In more severe scenarios, if the database user has elevated permissions, the attacker may be able to read or write arbitrary files on the filesystem or execute OS commands depending on the database configuration.\nThe vulnerability affects all versions of FilePress up to and including 3.0.1. Because the exploit is publicly documented and requires no specific authentication, the attack surface is exposed to any remote user capable of reaching the web server hosting the FilePress installation.\nThis flaw is symptomatic of a failure to enforce the principle of least privilege in data access layers and a lack of strict input type validation for control parameters that should be restricted to a predefined list of allowed column names."
}