CVE-2026-63152: Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to supply the _idCategoryFilter parameter. The vulnerable behavior affects installations running versions before 26.10.0.
What makes this a second-order injection risk?
The supplied filter value is first persisted in the session rather than necessarily being executed immediately. SQL is injected later when that stored filter is applied in app/Common/MdlCategory.php.
What can an attacker achieve?
Successful exploitation can lead to unauthorized database access or database manipulation. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact stated.
What should be done if the installation cannot be upgraded immediately?
The available information identifies the _idCategoryFilter input and the later filter-application path as the exposure points, but does not provide a validated workaround. Prioritize upgrading to 26.10.0 or later and restrict access to authenticated users until remediation is complete.