CVE-2026-71292 in Subrion
Summary
by MITRE • 08/05/2026
Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the `dir` (ASC/DESC) request parameter via in_array(), but falls back to the raw, attacker-supplied `sort` GET parameter whenever the requested key is not present in the per-controller $_gridSorting whitelist array: `$column = isset($this->_gridSorting[$params['sort']]) ? ... : $params['sort'];`, which is then placed into `sprintf(' ORDER BY %s`%s` %s', $tableAlias, $column, $direction)` with only backtick-quoting and no escaping. Because a backtick in the payload breaks out of the identifier context, an authenticated admin session can inject arbitrary SQL (error-based via EXTRACTVALUE, or time-based via SLEEP()) to extract database contents including administrator password hashes. Most of Subrion's ~29 admin grid controllers either define no $_gridSorting whitelist at all (e.g. pages.php, transactions.php, languages.php) or an incomplete one covering only some of their sortable columns (e.g. members.php whitelists only 1 of 7 sortable fields), making the vast majority of admin grid endpoints exploitable.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability identified in Subrion CMS represents a critical SQL injection flaw within the administrative grid sorting functionality that leverages improper input validation and sanitization mechanisms. This issue exists in the _gridGetSorting() method located in includes/classes/ia.base.controller.admin.php, where the application implements a flawed approach to handling user-supplied sorting parameters. The system employs a whitelist validation for the direction parameter 'dir' using in_array() function, correctly validating against only predefined ASC or DESC values, but fails to apply equivalent protection to the critical 'sort' parameter that determines which database column to sort by.
The technical flaw stems from a logic error in the sorting parameter handling where the application performs a conditional check against $_gridSorting whitelist array for the sort parameter. When the requested sort key is not found in this whitelist, the code directly assigns the raw attacker-supplied sort value without any sanitization or escaping. This assignment occurs through the expression `$column = isset($this->_gridSorting[$params['sort']]) ? ... : $params['sort'];` which effectively allows arbitrary column names to be passed into the SQL query construction process. The vulnerability becomes exploitable because the resulting SQL query concatenates this unsanitized column name directly into the ORDER BY clause using sprintf() with only backtick quoting for identifier protection.
The operational impact of this vulnerability is severe as it requires only an authenticated administrative session to exploit, eliminating the need for additional authentication bypasses or privilege escalation. The exploitation technique utilizes the backtick character in SQL identifiers to break out of the expected column context and inject malicious SQL payloads. Attackers can leverage error-based techniques through EXTRACTVALUE functions or time-based approaches using SLEEP() statements to extract sensitive database information including administrator password hashes. This makes the vulnerability particularly dangerous as it provides direct access to authentication credentials that could lead to full system compromise.
The widespread nature of this vulnerability affects approximately 29 admin grid controllers within Subrion CMS, with most controllers either lacking any $_gridSorting whitelist definitions or maintaining incomplete whitelists covering only a subset of sortable columns. This pattern demonstrates poor security implementation practices and highlights the lack of consistent input validation across the application's administrative interfaces. The vulnerability maps directly to CWE-89 SQL Injection and can be categorized under ATT&CK technique T1213 Data from Information Repositories, representing a critical weakness in database query construction that affects multiple administrative endpoints simultaneously.
Mitigation strategies should focus on implementing comprehensive parameter validation for all user-supplied sorting parameters regardless of their presence in whitelists. The most effective approach involves creating a complete whitelist for all sortable columns across all controllers and ensuring that any value not explicitly permitted is rejected or sanitized through proper escaping mechanisms. Additionally, the application should implement proper SQL identifier escaping that goes beyond simple backtick quoting to prevent injection attacks. Regular security audits of similar code patterns throughout the application are essential to identify and remediate other potential SQL injection vulnerabilities that may exist in different parts of the system.