phishingclub Phishing Club up to 1.30.1 Endpoint RemapOrderBy sortBy sql injection

Summaryinfo

A vulnerability marked as critical has been reported in phishingclub Phishing Club up to 1.30.1. The impacted element is the function RemapOrderBy of the component Endpoint. Performing a manipulation of the argument sortBy results in sql injection. This vulnerability is known as CVE-2026-28226. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in phishingclub Phishing Club up to 1.30.1. It has been classified as critical. This affects the function RemapOrderBy of the component Endpoint. The manipulation of the argument sortBy with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-28226 since 02/25/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

Upgrading to version 1.30.2 eliminates this vulnerability. Applying the patch c7e666da9a71cd519f317cbf67ade10068a33070 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• phishingclub

Name

• Phishing Club

Version

• 1.30.0
• 1.30.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion