Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Admin-panel endpoint likely requires at least low-privilege authentication; SQL injection enables full database read/write warranting C:H and I:H, not the supplied C:L/I:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints
AnalysisAI
SQL injection in GoAdminGroup GoAdmin (all versions through last release v1.2.26) exposes every /admin/info/{table} endpoint via the unsanitized __sort_type URL parameter, enabling network-accessible attackers to read and manipulate the underlying database and - if the database engine's command-execution features are active - escalate to OS-level code execution. No public exploit has been identified at time of analysis and EPSS is low at 0.34% (26th percentile); however, SSVC rates technical impact as total, directly contradicting the supplied CVSS C:L/I:L impact ratings - a discrepancy that warrants independent vendor verification. Authentication requirements for the affected admin-panel endpoint are unresolved, which is the single largest variable in assessing real-world risk.
Technical ContextAI
GoAdmin (GoAdminGroup/go-admin) is an open-source Go framework for building web-based administrative management panels. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: the __sort_type GET parameter supplied to /admin/info/{table} routes is incorporated into SQL query construction without parameterized binding or input sanitization, allowing an attacker to append arbitrary SQL clauses. Depending on the database backend (MySQL, PostgreSQL, SQLite, MSSQL are all supported by GoAdmin), this can facilitate UNION-based or error-based data extraction. MSSQL deployments with xp_cmdshell enabled, or MySQL with UDF-based extensions, would be candidates for escalation to RCE as claimed in the description. The NVD CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder with no vendor or product identifier, so affected version boundaries beyond 'up to v1.2.26' are not formally enumerated in NVD data.
RemediationAI
No vendor-released patch has been identified at time of analysis - the CVE description references v1.2.26 as the last release, and none of the provided references link to a fix commit, tagged release, or vendor security advisory. The GitHub repository (https://github.com/GoAdminGroup/go-admin/tree/main) should be monitored for new commits addressing SQL parameterization in the __sort_type query-building code path. As an immediate compensating control, place the GoAdmin panel behind a VPN or IP-based allowlist to restrict exposure to trusted networks only - this is the most effective mitigation and has minimal operational side effects. Deploy a WAF rule that rejects requests containing SQL metacharacters (quotes, comment sequences, UNION keywords) in the __sort_type parameter; note this may generate false positives on unusual but legitimate sort values and should be tuned. Disable database-side command-execution features where possible (e.g., set secure_file_priv on MySQL, revoke xp_cmdshell on MSSQL) to eliminate the RCE escalation path even if injection succeeds - this has no impact on normal application functionality. Refer to the VulDB advisory at https://vuldb.com/vuln/375649 for any emerging patch information.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today