Unauthenticated SQL Injection in MajorDoMo by MajorDoMo

CVE-2026-27179

What is CVE-2026-27179?

MajorDoMo, a home automation framework, contains a significant SQL injection vulnerability within its commands module. The flaw arises from a lack of input sanitization in the commands_search.inc.php file, where the $_GET['parent'] parameter is directly interpolated into SQL queries. This issue is particularly concerning as the commands module can be accessed unauthenticated via the /objects/?module=commands endpoint, which allows attackers to invoke arbitrary modules. By leveraging time-based blind SQL injection techniques with UNION SELECT SLEEP() syntax, an attacker can exploit this vulnerability to extract sensitive information, including unsalted MD5 hashed admin passwords stored in the users table. Successfully exploiting this vulnerability could ultimately grant an attacker access to the admin panel, posing serious risks to data integrity and security.

References