CVE-2026-96600
Received Received - Intake

Isotope eCommerce Blind SQL Injection via Backend Callbacks

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96600
EUVD
EUVD-2026-85341

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
isotope core 2.9.10
isotope core to 2.9.10 (inc)
isotope ecommerce 2.9.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a blind SQL injection flaw in Isotope eCommerce through version 2.9.10. It allows authenticated Contao backend users with Isotope module permissions to inject malicious SQL payloads by manipulating identifiers and administrator-supplied values directly into SQL statements. Attackers can use conditional and time-based injection techniques to extract sensitive data, including user password hashes from the tl_user table.

Detection Guidance

To detect this vulnerability, monitor for unusual SQL query patterns or delays in backend responses from Isotope eCommerce callbacks. Check Contao backend logs for unauthorized data extraction attempts, especially from the tl_user table. Use tools like SQLMap to test for blind SQL injection in affected callbacks (e.g., Callback::onLoad(), validateForeignKey(), ProductPrice callbacks).

Commands to test for blind SQLi: sqlmap -u "<target_url>" --data="<POST_params>" --batch --level=5 --risk=3 --dbms=mysql --technique=B. Look for time delays or conditional errors in responses.

Impact Analysis

If you are an authenticated Contao backend user with Isotope module permissions, an attacker could exploit this to extract sensitive data like user password hashes from your database. This could lead to unauthorized access to user accounts and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Isotope eCommerce to the latest version beyond 2.9.10. Restrict Contao backend user permissions to only necessary Isotope module functions. Disable or audit all backend callbacks handling user-supplied input, especially those interacting with the tl_user table.

Apply input validation for all identifiers and administrator-supplied values in SQL queries. Use prepared statements or ORM methods instead of direct SQL interpolation. Monitor for suspicious backend activity or unauthorized data access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart