CVE-2026-63167: Omnispace Agora Project 26.10.0 SQL Injection via personsSort Session Value
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a general administrator. The vulnerable input is the personsSort session value.
Which application functions expose the injection?
The injection reaches unsanitized ORDER BY clauses in MdlUser.php and MdlSpace.php. It can be triggered through the user and space listing pages.
What can an attacker obtain through the demonstrated technique?
An attacker can use an error-based extractvalue payload to disclose database information through application errors. The described example leaks the MariaDB version.