CVE-2026-62998
Received Received - Intake

SQL Injection via Unauthorized ORDER BY in REDAXO

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-62998
EUVD
EUVD-2026-85332

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redaxo redaxo to 5.21.2 (exc)
redaxo redaxo 5.21.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in REDAXO CMS (versions before 5.21.2) involves improper input validation in the rex_list component. The getSortColumn() method accepts a 'sort' parameter from user input without verifying if the column is registered as sortable. While the input is escaped to prevent SQL injection, attackers can still manipulate the ORDER BY clause to include sensitive columns like rex_user.password. This enables error-based enumeration of column names and unauthorized data ordering.

Detection Guidance

To detect this vulnerability, inspect the REDAXO backend for any custom list components using rex_list that accept user-controlled sort parameters. Check server error logs for MySQL errors indicating invalid column names in ORDER BY clauses. Review GET requests to backend URLs containing sort parameters for unvalidated column names.

Impact Analysis

An authenticated backend user could exploit this to access sensitive data like password hashes, reorder data silently based on sensitive fields, or enumerate database column names through error messages. The impact is limited to authenticated users with backend access but could lead to information disclosure or data manipulation.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive user data (e.g., passwords) or personal information, potentially breaching GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized data access or manipulation may lead to regulatory penalties or loss of certification.

Mitigation Strategies

Immediately upgrade REDAXO to version 5.21.2 or later. If upgrading is not possible, review all rex_list instances to ensure the sort parameter is validated against a whitelist of sortable columns. Disable backend access for non-essential users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart