CVE-2026-38468: SQL Injection
A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to tools.php?action=getcc.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be remotely authenticated and have the users_view_ips privilege. Unauthenticated users and authenticated users without that privilege are not described as able to exploit it.
What request path and input are involved?
The affected country-code lookup endpoint is tools.php?action=get_cc. Exploitation uses a crafted value in the ip parameter.
What is the potential impact of successful exploitation?
A successful attacker can execute arbitrary SQL commands through the SQL injection vulnerability. The issue is associated with GazellePW commit 86c4bedf727691b5a97af42a4864869d18446449.