What is the CVSS score of CVE-2026-30711?

CVE-2026-30711 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30711?

Devome GRR v4.5.0 contains a SQL injection vulnerability in session handling that allows authenticated attackers to compromise the entire database, including exfiltration and modification of…

How to fix or mitigate CVE-2026-30711?

Within 24 hours: Inventory all systems running Devome GRR v4.5.0 and restrict database access to trusted networks only. Within 7 days: Apply input validation rules at the application layer to sanitize referer and user-agent headers, and consider implementing Web Application Firewall (WAF) rules to block malicious SQL patterns in these parameters. Within 30 days: Contact Devome for patched version availability and plan upgrade to a non-vulnerable release once available; monitor vendor advisory channels for patch release timeline.

PHP CVE-2026-30711

HIGH

SQL Injection (CWE-89)

2026-03-19 cve@mitre.org

PHP SQLi

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Mar 20, 2026 - 13:52 vuln.today

CVE Published

Mar 19, 2026 - 15:16 nvd

HIGH 8.8

DescriptionCVE.org

Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent.

AnalysisAI

Authenticated attackers can execute arbitrary SQL queries in Devome GRR v4.5.0 through injection vulnerabilities in the referer and user-agent parameters within include/session.inc.php, enabling full database compromise including data exfiltration, modification, and potential remote code execution. The vulnerability carries a CVSS score of 8.8 (High) with low attack complexity requiring only low-level privileges and no user interaction. EPSS probability of exploitation is extremely low at 0.01% (2nd percentile), and no public exploit identified at time of analysis beyond technical disclosure and audit documentation.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) affecting the session management component of Devome GRR, a PHP-based application. The vulnerable file include/session.inc.php improperly sanitizes HTTP referer and user-agent headers before incorporating them into SQL queries. SQL injection occurs when untrusted input is concatenated directly into SQL statements without parameterization or adequate escaping, allowing attackers to manipulate query logic. The dual injection points (referer and user-agent) suggest inadequate input validation across HTTP headers used for session tracking or logging purposes. PHP applications frequently suffer from SQL injection when using legacy database APIs or string concatenation instead of prepared statements with bound parameters.

Affected ProductsAI

Devome GRR version 4.5.0 is confirmed vulnerable based on the technical audit published at breakpoint.purrfect.fr. The vulnerability affects the include/session.inc.php component specifically, which handles session management functionality. No CPE string was provided in the available intelligence, limiting automated vulnerability scanning detection. The advisory references from VulDB (ID 351717) and the detailed technical audit at https://breakpoint.purrfect.fr/article/grr_audit.html#v4-sql-injection-in-session-inc-php-1 provide comprehensive vulnerability analysis. Other versions of Devome GRR were not explicitly mentioned in the available data, so the scope may be limited to v4.5.0 or the vendor has not disclosed the full affected version range.

RemediationAI

Upgrade Devome GRR beyond version 4.5.0 to a patched release if available from the vendor. Consult the technical audit at https://breakpoint.purrfect.fr/article/grr_audit.html for complete vulnerability details and coordinate with the vendor for patch availability status, as no specific fixed version was identified in the provided intelligence. Until patching is complete, implement defense-in-depth controls including strict authentication controls to limit who can obtain the required low-level privileges (PR:L), web application firewall rules to detect and block SQL injection patterns in referer and user-agent headers, database user privilege restrictions to limit the impact of successful SQL injection (principle of least privilege), and enhanced logging of database queries from the session.inc.php component to detect exploitation attempts. Review application logs for suspicious referer or user-agent values containing SQL syntax (UNION, SELECT, OR 1=1, etc.) that may indicate prior exploitation.