CVE-2026-62998

Description

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

Traduire en français

Produits concernés

• redaxo core
• Redaxo redaxo

Scores CVSS

Faiblesses (CWE)

• CWE-20
• CWE-200

Références

• https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd Patch
• https://github.com/redaxo/core/pull/6580 Issue TrackingPatch
• https://github.com/redaxo/core/releases/tag/5.21.2 Release Notes
• https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 ExploitVendor Advisory
• https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories