CVE-2026-62998: REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rexuser.password. This issue is fixed in version 5.21.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXOto a version that resolves this vulnerability.Fixed in 5.21.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated REDAXO backend user can exploit it. No user interaction is required, and the attack can be performed over the network.
Which deployments are affected?
REDAXO versions prior to 5.21.2 are affected where rex_list::getSortColumn() processes the sort request parameter. Version 5.21.2 contains the fix.
What can an attacker obtain or do?
An attacker can use error-based behavior to enumerate columns in joined tables and can order results using unselected sensitive fields, including rex_user.password. The provided severity vector indicates low confidentiality impact, with no integrity or availability impact.
How can I mitigate the issue if I cannot upgrade immediately?
The provided data does not identify a workaround. Restricting access to authenticated backend accounts can reduce exposure because exploitation requires a backend user account.