CVE-2026-100847 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The AzuraCast platform, prior to version 0.23.8, contains a critical Database Query Language injection vulnerability located within the AbstractSearchableListAction.php component. This flaw specifically affects the sortOrder API parameter, which is designed to dictate how search results are ordered in database queries. The underlying technical issue stems from insufficient input validation and sanitization of user-supplied data before it is incorporated into DQL statements. Unlike standard SQL injection where raw SQL syntax is injected, this vulnerability allows attackers to manipulate the structure of Doctrine Query Language expressions. Because the application fails to restrict the sortOrder parameter to a predefined list of safe column names or sorting directions, an attacker can inject arbitrary DQL fragments that alter the query logic beyond simple ordering, effectively bypassing intended access controls and data retrieval boundaries.
The operational impact of this vulnerability is severe due to its potential for unauthorized data extraction. By crafting malicious payloads within the sortOrder parameter, attackers can execute complex queries designed to dump sensitive database contents. This includes extracting user credentials such as passwords and authentication tokens, which could lead to full account compromise. Furthermore, the attacker can access station settings and configuration details that are not intended for public or unprivileged consumption. The ability to extract arbitrary data means that an authenticated attacker with low privileges could escalate their influence within the system by stealing administrative credentials or sensitive operational metadata from other users on a multi-user instance of AzuraCast.
This vulnerability aligns closely with CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, specifically adapted here for DQL environments. It also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as the injection allows for arbitrary command execution within the database layer, facilitating data exfiltration techniques described under T1005. The lack of parameterized queries or strict whitelisting for sorting parameters represents a common pattern in web application development that leads to such high-severity flaws when input is directly concatenated into query strings without rigorous validation.
To mitigate this vulnerability, organizations running AzuraCast must immediately upgrade to version 0.23.8 or later where the issue has been resolved through improved input handling and strict parameter binding for sorting operations. For systems that cannot be updated instantly due to operational constraints, implementing a web application firewall rule to block suspicious characters in the sortOrder API parameter can provide temporary protection. Additionally, enforcing principle of least privilege on database accounts used by AzuraCast ensures that even if an injection occurs, the attacker's ability to read sensitive tables is restricted. Regular security audits focusing on ORM usage and query construction practices are recommended to prevent similar DQL or SQL injection vectors in future development cycles.