CVE-2026-71292

7.2 Élevée

Publiée le 05/08/2026 à 15:24 · Modifiée le 26/08/2026 à 19:13 · Analyse NVD reportée · Source : 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.

Traduire en français

Produits concernés

intelliants subrion

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-89

Références

https://github.com/intelliants/subrion
https://github.com/intelliants/subrion/blob/master/includes/classes/ia.base.controller.admin.php

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories