SQL Injection Vulnerability in Subrion CMS Admin Grid

CVE-2026-71292

What is CVE-2026-71292?

The Subrion CMS's admin grid sorting helper is vulnerable to SQL injection due to improper handling of request parameters. When the expected sorting key is not found in the whitelist, it defaults to using the raw sort GET parameter, which allows an authenticated attacker to manipulate database queries. This flawed implementation can lead to the unauthorized disclosure of sensitive information, including administrator password hashes. The exploitability of this vulnerability is exacerbated by the presence of inadequate or absent whitelisting across various admin grid controllers.

References