CVE-2026-38468
Deferred Deferred - Pending Action

SQL Injection in GazellePW via Country-Code Lookup

Publication date: 2026-08-25

Last updated on: 2026-08-31

Assigner: MITRE

Description
A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_view_ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to tools.php?action=get_cc.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-31
Generated
2026-09-15
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-13
NVD
CVE-2026-38468
EUVD
EUVD-2026-66173

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gazelleposterwall gazellepw *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in GazellePW (GazellePosterWall). It allows remote authenticated users with specific privileges to execute arbitrary SQL commands through the ip parameter in a request to tools.php?action=get_cc.

Detection Guidance

To detect this SQL injection vulnerability in GazellePW, inspect HTTP requests to tools.php?action=get_cc with the ip parameter. Look for unusual SQL syntax or errors in server logs. Use tools like sqlmap to test for injection by sending payloads such as ' OR 1=1 -- in the ip parameter.

Impact Analysis

An attacker could exploit this to manipulate or extract sensitive data from the database, potentially leading to unauthorized access, data breaches, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy), potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Immediately update GazellePW to the latest commit beyond 86c4bedf727691b5a97af42a4864869d18446449. Apply input validation to sanitize the ip parameter. Restrict users_view_ips privileges to only necessary personnel. Monitor logs for suspicious SQL queries or errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-38468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart