CVE-2026-72550 in Friendica
Summary
by MITRE • 08/11/2026
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical sql injection flaw in the friendica social networking platform affecting versions up to and including the 202608-dev branch. The vulnerability stems from improper input validation and sanitization of user-supplied data within the photo-view functionality where an order parameter is directly concatenated into a database query without appropriate escaping or parameterization. The specific implementation uses a bare pdo::query() call which bypasses the built-in protection mechanisms that would normally prevent sql injection attacks through proper parameter binding.
The technical exploitation occurs when an unauthenticated attacker manipulates the photo-view order parameter to inject malicious sql code into what should be a simple column listing operation using the show columns query syntax. This particular implementation allows for stacked statement injection, meaning multiple sql commands can be executed sequentially within a single request, dramatically expanding the attack surface and potential impact of the vulnerability. The lack of proper input sanitization combined with the use of direct query execution creates an ideal environment for arbitrary code execution at the database level.
The operational impact of this vulnerability is severe as it provides attackers with complete database access without requiring any authentication credentials. An attacker can leverage this vulnerability to read sensitive user data including personal information, private messages, and authentication credentials stored within the database. The ability to modify or delete database contents means that attackers could not only steal information but also corrupt or destroy the entire social network platform's data infrastructure, potentially leading to complete service disruption and loss of user trust.
This vulnerability maps directly to cwe-89 sql injection and aligns with several tactics in the mitre att&ck framework including initial access through web application attacks and privilege escalation via database manipulation. The attack pattern follows the typical progression where an attacker identifies a vulnerable input point, crafts malicious payload targeting the specific query construction method, and then executes commands that bypass traditional security controls. Organizations using friendica should immediately implement input validation measures including parameterized queries, proper escaping of user inputs, and regular security audits of database interactions to prevent similar vulnerabilities from being exploited in other components of their infrastructure.
Mitigation strategies should include immediate patching of the affected friendica versions, implementing web application firewalls with sql injection detection capabilities, and enforcing strict input validation at all points where user data is processed for database operations. Additionally organizations should conduct comprehensive security testing focusing on sql injection vulnerabilities across their entire application stack and establish proper monitoring for unusual database access patterns that might indicate exploitation attempts. The vulnerability demonstrates the critical importance of proper database query construction practices and the dangers of relying on direct query execution methods without adequate sanitization layers.