SQL Injection in GoAdminGroup GoAdmin

Compliance Impact

The SQL injection vulnerability in GoAdminGroup GoAdmin allows attackers to execute arbitrary code and exfiltrate sensitive information such as user credentials from the database.

This exposure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information against unauthorized access and breaches.

Therefore, exploitation of this vulnerability could result in violations of these standards due to the compromise of confidentiality and integrity of sensitive data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-51946 is a SQL Injection vulnerability in the GoAdmin framework, specifically in the __sort_type URL parameter used on all /admin/info/{table} endpoints.

The vulnerability arises because the __sort_type parameter is not properly validated before being interpolated into SQL queries using fmt.Sprintf. Although there is validation logic, the sanitized value is not stored, allowing the original unsanitized input to be used in query construction.

This flaw allows attackers to perform both time-based and error-based SQL injection attacks, enabling them to execute arbitrary code and extract sensitive information such as user credentials from the database.

Additionally, the lack of output encoding on this parameter results in a reflected Cross-Site Scripting (XSS) vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized execution of arbitrary code on the affected system.

Attackers can exploit the SQL injection to extract sensitive information such as user credentials from the database.

The reflected XSS vulnerability can also be exploited to execute malicious scripts in the context of users' browsers, potentially leading to session hijacking or other attacks.

Overall, this can lead to data breaches, loss of data confidentiality, and compromise of system integrity.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability can be detected by testing the __sort_type URL parameter on the /admin/info/{table} endpoints for SQL injection. Specifically, sending crafted payloads that exploit SQL injection techniques such as time-based or error-based injections can reveal the vulnerability.

For example, you can use curl or similar HTTP clients to send requests with malicious payloads in the __sort_type parameter and observe the responses for errors or delays indicative of SQL injection.

• curl -i 'http://target/admin/info/users?__sort_type=1 OR 1=1--'
• curl -i 'http://target/admin/info/users?__sort_type=1; WAITFOR DELAY '0:0:5'--'

These commands attempt to trigger error-based or time-based SQL injection responses, which can help detect the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /admin/info/{table} endpoints to trusted users only, such as by implementing IP whitelisting or strong authentication controls.

Additionally, avoid exposing the vulnerable __sort_type parameter to untrusted users and monitor logs for suspicious requests targeting this parameter.

Ultimately, updating to a patched version of GoAdmin that properly sanitizes and validates the __sort_type parameter before using it in SQL queries is necessary to fully remediate the issue.

Useful 0 Not Useful 0