CVE-2026-105146: Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection
A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The affected versions are Comsenz Discuz! X5.0-20260801, X5.0-20260820, and X5.0-20260910. The vulnerable code is in the Admin Medal Moderation component's mod.php file.
What access does an attacker need?
The CVSS vector indicates high privileges are required (PR:H), while the attack can be performed remotely and requires no user interaction. Exploitation involves manipulating the delete argument of the modmedalsubmit function.
Is public exploit code available?
Yes. The vulnerability information states that an exploit has been made public and could be used.
What is the potential impact of successful exploitation?
Successful exploitation can affect confidentiality, integrity, and availability to a low extent according to the supplied CVSS metrics. The issue is classified as SQL injection.