CVE-2026-63152
Deferred Deferred - Pending Action

Omnispace Agora SQL Injection via Session Persistence

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-17
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-63152
EUVD
EUVD-2026-100577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Omnispace Agora Project 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a second-order SQL injection vulnerability in Omnispace Agora Project versions before 26.10.0. It allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter. The payload is stored in the session and later used in a SQL statement without proper parameterization, leading to unauthorized database access or manipulation.

Detection Guidance

To detect this vulnerability, inspect HTTP requests and session data for the _idCategoryFilter parameter in app/Common/MdlCategory.php. Look for SQL injection patterns like quotes, semicolons, or SQL keywords in stored session values. Monitor database logs for unusual queries or errors.

Impact Analysis

An attacker could exploit this to access or manipulate sensitive data in the database. Since it requires authentication, the attacker must first gain access to a valid account. The impact includes potential data breaches, unauthorized modifications, or even complete database compromise depending on the application's permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, which directly violates GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Upgrade to version 26.10.0 or later immediately. If upgrading is not possible, implement strict input validation for the _idCategoryFilter parameter and ensure all SQL queries use parameterized statements to prevent injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63152. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart