What is the CVSS score of CVE-2026-38581?

CVE-2026-38581 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of thaipalliative_lte are affected by CVE-2026-38581?

SQL injection vulnerability (CVSS 9.8) in damasac thaipalliative_lte application enables remote attackers to execute arbitrary database queries, threatening data confidentiality and system integrity.

How to fix or mitigate CVE-2026-38581?

Within 24 hours: isolate the affected application from untrusted networks and implement Web Application Firewall (WAF) rules blocking SQL metacharacters in idFormMain and id parameters to /substudy/ezform.php; disable public access if operationally feasible. Within 7 days: deploy input validation and parameterized query monitoring, review database access logs for exploitation attempts, and document all deployed mitigations. Within 30 days: contact the vendor for patch timeline; if no patch is forthcoming, evaluate alternative healthcare applications and develop a migration plan.

thaipalliative_lte CVE-2026-38581

EUVD-2026-36241 CRITICAL

SQL Injection (CWE-89)

2026-06-11 cve@mitre.org

GHSA-vvmc-8xvf-rg7j

SQLi PHP

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote SQLi via a directly-exposed parameter (AV:N/AC:L/PR:N/UI:N); direct DB access yields total confidentiality, integrity and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:10 vuln.today

CVE Published

Jun 11, 2026 - 14:16 cve.org

CRITICAL 9.8

CVE Published

Jun 11, 2026 - 14:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14) and the id parameter (line 49). The parameters are concatenated directly into SQL queries without sanitization or parameterized statements.

Articles & Coverage 1

News Critical RCE in PHP - CVE-2026-38581 Jun 11, 2026

AnalysisAI

SQL injection in the damasac thaipalliative_lte application (through version 3.0) allows remote attackers to execute arbitrary SQL commands by supplying the idFormMain and id parameters to /substudy/ezform.php, which are concatenated directly into database queries without sanitization. No public exploit identified at time of analysis, though SSVC records a proof-of-concept exists and the flaw is fully automatable; EPSS is low at 0.08% (24th percentile), reflecting the product's obscurity rather than low technical severity.

Technical ContextAI

The affected code is a PHP web application (thaipalliative_lte, apparently a Thai palliative-care substudy data-collection form system) built around the ezform.php endpoint under /substudy/. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). At line 14 the idFormMain request parameter, and at line 49 the id parameter, are interpolated directly into SQL statements without parameterized queries or input escaping, so attacker-controlled input is parsed as SQL syntax. This is a classic string-concatenation SQLi pattern common in legacy PHP/MySQL codebases that predate the use of PDO/mysqli prepared statements.

RemediationAI

No vendor-released patch identified at time of analysis - the references point to source code and third-party advisories (NVD, VulDB, and the theemperorspath advisory) rather than a tagged fixed release. Operators should treat all versions through 3.0 as vulnerable and, as the primary fix, rewrite the ezform.php queries to use parameterized statements (PDO or mysqli prepared statements) so idFormMain and id are bound as parameters rather than concatenated; where source modification is possible, add strict server-side validation casting these identifiers to integers. As compensating controls until a fix is deployed: restrict network access to /substudy/ezform.php via authentication or IP allowlisting (trade-off: may block legitimate remote data entry), and deploy a WAF rule to block SQL metacharacters in the idFormMain and id parameters (trade-off: signature-based filtering can be bypassed and may cause false positives). Review the researcher advisory at https://github.com/theemperorspath/advisories/blob/main/2026/CVE-2026-38581.md for exploit specifics before validating any mitigation.