CVE-2026-107803 in ProcessMaker
Summary
by MITRE • 10/09/2026
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
ProcessMaker serves as a comprehensive open-source workflow management suite designed to automate business processes and streamline organizational efficiency. Within this software architecture, the application exposes various RESTful API endpoints to facilitate interaction with its core functionalities. One such endpoint is GET /api/1.0/tasks, which allows authenticated users to retrieve lists of tasks associated with their workflows. This specific interface point became a vector for SQL injection attacks in versions prior to 2026.14.3 due to improper handling of user-supplied input within the backend logic responsible for sorting task data.
The technical root cause of this vulnerability lies in the implementation of the ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering() method. This function is tasked with applying sort orders to database queries based on parameters provided by the client. Specifically, it processes the order_by parameter, which dictates how the resulting dataset should be arranged. Instead of validating or sanitizing this input against a whitelist of allowed column names, the application directly concatenates the user-controlled value into a DB::raw() SQL subquery. This practice bypasses standard query parameterization mechanisms that would otherwise escape special characters and prevent malicious code execution. By allowing arbitrary strings to be inserted directly into the SQL structure, the application fails to distinguish between legitimate sorting instructions and injected SQL commands.
This flaw enables any authenticated user to perform blind time-based SQL injection attacks against the underlying database. Because the vulnerability allows for the construction of complex queries without immediate error feedback or data leakage in a single request, attackers must rely on inferential techniques. By manipulating the order_by parameter to include conditional logic that triggers delays based on specific conditions, an attacker can systematically extract sensitive information from the ProcessMaker database account privileges allow access to. This includes potentially extracting user credentials, workflow configurations, and other confidential business data stored within the system's tables. The ability to execute arbitrary SQL commands effectively compromises the integrity of the entire application environment by granting unauthorized read access to persistent storage.
From a classification perspective, this vulnerability is categorized under CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It also aligns with ATT&CK technique T1059 Command and Scripting Interpreter if the injection leads to further exploitation steps, though primarily it represents data exfiltration via T1213 Data from Information Repositories. The impact is significant for organizations relying on ProcessMaker for critical operations, as the exposure of database contents can lead to credential theft, unauthorized access to sensitive workflows, and potential lateral movement within the network if those credentials are reused elsewhere.
To mitigate this risk, administrators must upgrade ProcessMaker to version 2026.14.3 or later, where the developers have implemented proper input validation and parameter binding for the order_by functionality. In addition to upgrading, organizations should enforce strict access controls on API endpoints, ensuring that only necessary roles can interact with task management interfaces. Implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests. Regular security audits and code reviews focusing on dynamic query construction are also recommended to prevent similar vulnerabilities from being introduced during future development cycles.