CVE-2026-73670: CMS Admin SQL Injection via db_data.php table_name Parameter
A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as informationschema, and chain the disclosure with secondary injection points to extract credential data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73670?
CVE-2026-73670 has a severity rating of 7.2, which is categorized as high.
How does CVE-2026-73670 affect CMS security?
CVE-2026-73670 allows authenticated administrators to exploit a SQL injection vulnerability, risking data integrity and confidentiality.
Which component is vulnerable in CVE-2026-73670?
The vulnerability exists in the admin/db_data.php file, specifically at line 509.
Who is at risk with CVE-2026-73670?
Authenticated administrators of the CMS are at risk as they can unintentionally introduce SQL injection through unsanitized input.
How can I mitigate CVE-2026-73670?
Mitigation of CVE-2026-73670 involves sanitizing all input parameters, particularly the table_name parameter, to prevent SQL injection attacks.