CVE-2026-88756 in Pagekit
Summary
by MITRE • 09/22/2026
Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Pagekit Content Management System versions up to and including 1.0.18 represents a critical security flaw within the authentication mechanism, specifically affecting the user authentication endpoint located at POST /user/authenticate. This issue stems from improper input validation and sanitization practices when processing credentials submitted by clients attempting to log into the system. Because this endpoint is publicly accessible without requiring prior authentication, it serves as an attractive target for unauthenticated attackers seeking to compromise the integrity of the database backend that supports the CMS functionality. The core technical flaw involves the direct inclusion of user-supplied data from the credentials array into SQL queries without adequate escaping or parameterization, allowing malicious actors to inject arbitrary SQL commands that are executed by the underlying database management system.
From a technical perspective, this vulnerability is classified under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attacker can manipulate the structure of the authentication request by injecting malicious payloads into fields such as username or password. By carefully crafting these inputs, it becomes possible to bypass standard access controls, extract sensitive data from other tables within the database, modify existing records, or even execute administrative commands depending on the privileges granted to the database user account running the application. This type of attack exploits the trust placed in input fields by developers who may have assumed that the authentication logic would handle all edge cases securely, failing to recognize that raw string concatenation remains a prevalent and dangerous anti-pattern in web development.
The operational impact of this vulnerability is severe, as it grants an unauthenticated actor full control over the data layer associated with Pagekit CMS. Successful exploitation can lead to unauthorized access to user accounts, including administrative privileges if such credentials exist within the database. Furthermore, attackers can exfiltrate sensitive information such as email addresses, hashed passwords, and other personally identifiable information stored in the system. In more advanced scenarios involving stacked queries or specific database configurations like MySQL with certain extensions enabled, it may even be possible to execute operating system commands on the server hosting the application, leading to a complete compromise of the underlying infrastructure. This level of access undermines the confidentiality, integrity, and availability principles that are central to information security frameworks.
In terms of threat modeling and adversary behavior, this vulnerability aligns with techniques described in the MITRE ATT&CK framework, particularly those related to initial access and credential harvesting. Attackers often utilize automated tools to scan for such vulnerabilities across large portions of the internet, exploiting them at scale before patches are widely deployed. The lack of authentication requirement makes this a low-effort, high-reward target for opportunistic attackers looking to establish a foothold in vulnerable environments or to use compromised systems as part of larger botnets or data theft operations.
To mitigate this risk, immediate action is required by administrators and developers managing Pagekit installations. The primary remediation strategy involves upgrading the CMS to version 1.0.19 or later, where the authentication logic has been corrected to properly sanitize inputs and utilize prepared statements for database interactions. For organizations unable to upgrade immediately due to compatibility constraints with custom plugins or themes, implementing a Web Application Firewall (WAF) can provide temporary protection by filtering out malicious SQL patterns in incoming requests. Additionally, enforcing strict input validation on all user-supplied data and ensuring that the database account used by the application operates under the principle of least privilege will help limit the potential damage if an injection attempt succeeds. Regular security audits and code reviews focusing on database interaction layers are also recommended to prevent similar vulnerabilities from being introduced in future updates or custom developments.