CVE-2026-105146 in Discuz!
Summary
by MITRE • 10/04/2026
A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified within Comsenz Discuz! versions X5.0-20260801 through X5.0-20260910 represents a critical security flaw located specifically within the Admin Medal Moderation component. This issue resides in the modmedalsubmit function found in the file upload/source/app/admin/child/medals/mod.php. The core technical deficiency is a SQL injection vulnerability triggered by improper handling of the delete argument passed to this function. In web application architecture, input validation and sanitization are paramount for preventing malicious code execution within database queries. Here, the developer failed to adequately sanitize or parameterize user-supplied data before incorporating it into an SQL statement. This oversight allows an attacker to inject arbitrary SQL commands that will be executed by the underlying database management system with the privileges of the web application process.
From a technical perspective, this flaw aligns directly with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. The vulnerability is classified under OWASP Top 10 A3:2021 - Injection, highlighting its severity and prevalence in modern web applications. Because the affected function operates within the administrative interface for medal moderation, it implies that the attacker likely requires some level of authentication or access to the admin panel to trigger this specific vector. However, if the application suffers from additional weaknesses such as broken access control or credential stuffing vulnerabilities, an external threat actor could gain the necessary foothold to exploit this SQL injection remotely. The ability to manipulate the delete argument suggests that the attacker can alter database queries intended for removing records, potentially leading to data exfiltration, modification of critical system configurations, or even complete compromise of the backend database depending on the specific query structure and database engine capabilities.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a public exploit. Once an attacker successfully injects malicious SQL code, they can extract sensitive information from the database, including user credentials, personal identifiable information, and session tokens stored within Discuz instance.
The ATT&CK framework maps this activity primarily to T1059 Command and Scripting Interpreter for any script-based exploitation techniques used during post-exploitation, but more accurately to T1190 Exploit Public-Facing Application as the initial vector. The lateral movement phase might involve T1078 Valid Accounts if stolen credentials are reused across systems. Given that the vendor has not responded to disclosure attempts despite being contacted early, organizations running affected versions of Discuz! face significant risk without an official patch or mitigation guidance from Comsenz. This lack of response necessitates immediate proactive measures by system administrators and security teams responsible for maintaining these environments.
Mitigation strategies must focus on compensating controls since no vendor fix is available at this time. The most effective defense against SQL injection remains the implementation of parameterized queries or prepared statements in application code, ensuring that user input is treated strictly as data rather than executable code. However, given the unpatched state of the software, immediate remediation requires network-level interventions. Administrators should restrict access to the admin panel and specifically to the mod.php file using strict IP whitelisting for trusted administrative networks only. Additionally, deploying a Web Application Firewall with rules tuned to detect SQL injection patterns in POST parameters can provide an effective layer of defense by blocking malicious payloads before they reach the vulnerable application logic. Input validation should also be enforced at multiple layers, rejecting any input containing characters commonly associated with SQL syntax such as single quotes, double dashes, or semicolons unless explicitly required and safely encoded. Regular vulnerability scanning and penetration testing are recommended to identify similar flaws in other parts of the Discuz! installation that may have been overlooked during initial development.