CVE-2026-71292
Received Received - Intake

SQL Injection in Subrion CMS Admin Grid

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-10
Generated
2026-08-17
AI Q&A
2026-08-05
EPSS Evaluated
2026-08-16
NVD
CVE-2026-71292
EUVD
EUVD-2026-53377

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
subrion cms *
intelliants subrion From 4.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Subrion CMS where the admin grid sorting function fails to properly validate user input. It whitelists the sorting direction parameter but uses an attacker-controlled parameter when the whitelist is incomplete. This allows SQL injection via backtick characters breaking out of identifier context, enabling arbitrary SQL execution like extracting data or manipulating the database.

Detection Guidance

Check for unauthenticated admin grid endpoints in Subrion CMS by inspecting network traffic for GET requests to admin controllers like pages.php, members.php, or transactions.php with sort or dir parameters. Look for SQL error messages or time delays in responses indicating SQL injection attempts.

Impact Analysis

An authenticated admin user can exploit this to inject malicious SQL commands. This could lead to unauthorized data access, modification, or deletion in the database. Attackers could extract sensitive information like administrator password hashes, alter system configurations, or perform other database operations.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using Subrion CMS may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Subrion CMS to the latest patched version immediately. If no patch is available, restrict access to admin panels via IP whitelisting and disable unauthenticated admin grid endpoints. Review and enforce strict $_gridSorting whitelists for all admin controllers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart