CVE-2026-111619 in FilePress
Summary
by MITRE • 10/16/2026
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
FilePress version 3.0.1 is susceptible to a critical SQL injection vulnerability that stems from the improper validation of user-supplied input within specific application endpoints. This flaw specifically affects authenticated users who possess low-privilege access levels, allowing them to manipulate database queries through unvalidated parameters in the asc field. The technical root cause lies in the handling of sorting directives where the application fails to sanitize or parameterize the input before incorporating it into SQL statements. Although typical SQL injection vulnerabilities often target data retrieval via WHERE clauses, this particular instance exploits the ORDER BY clause, which is frequently overlooked by developers because standard prepared statement mechanisms do not support binding values for column names or sort directions. Consequently, attackers can inject arbitrary SQL logic directly into the query structure, bypassing conventional input filtering measures that might otherwise block malicious payloads in other parts of the application.
The exploitation vector targets two specific PHP files within the FilePress architecture: dzz/pichome/library/filelist.php and dcz/collection/filelist.php. These components are responsible for rendering file lists and managing collection views, making them high-traffic entry points that process user requests frequently. By injecting malicious payloads into the asc parameter, an attacker can construct blind boolean-based or time-based subqueries. This technique allows the extraction of sensitive database rows without requiring direct output display from the application itself. The stealth nature of these injection methods means that the vulnerability may remain undetected by standard intrusion detection systems for extended periods, as it does not produce obvious error messages or visible changes in the user interface during normal operation.
The operational impact of this vulnerability is severe due to its ability to facilitate unauthorized data extraction and privilege escalation. Attackers can leverage the injected SQL commands to dump database contents, including administrator credential hashes. The compromise of these hashes poses a significant risk as they can be subjected to offline brute-force or rainbow table attacks to recover plaintext passwords. Once an attacker obtains valid administrative credentials, they gain full control over the FilePress instance, enabling them to modify system configurations, exfiltrate sensitive business data, install web shells for persistent access, and potentially pivot to other systems within the internal network. This scenario aligns with common attack patterns where initial low-privilege access is leveraged to achieve high-level administrative rights through credential theft.
From a classification perspective, this vulnerability corresponds to CWE-89 Improper Neutralization of Special Elements used in an SQL Command and falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter via database queries or T1114 Email Collection if the extracted data includes email addresses. To mitigate this risk, developers must implement strict input validation for all parameters that influence query structure, particularly those affecting ORDER BY clauses. The most effective remediation strategy involves using allowlists to restrict acceptable values for sorting directions rather than attempting to blacklist malicious characters. Additionally, implementing parameterized queries where possible and ensuring that database accounts used by the application adhere to the principle of least privilege can significantly reduce the blast radius of such exploits. Regular security audits focusing on dynamic SQL construction are essential to identify similar weaknesses in other parts of the codebase before they can be exploited in production environments.