EUVD-2026-53318
GHSA-rq57-g9hr-4f9r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-accessible web endpoint exploitable by any authenticated session (PR:L); no complexity barriers; SQL injection yields high confidentiality and limited integrity impact with no availability effect.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
2DescriptionCVE.org
Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks.
AnalysisAI
SQL injection in Mautic's getLeadIdsByFieldValueAction endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious field parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, InputHelper::clean(), HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.
Technical ContextAI
Mautic is a PHP-based open-source marketing automation platform built on Symfony and Doctrine ORM (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code path is in LeadBundle/Controller/AjaxController.php inside getLeadIdsByFieldValueAction, which reads a field request parameter and passes it to LeadRepository::buildQueryForGetLeadsByFieldValue(). There, the identifier is assembled as $col = 'l.'.$field and concatenated directly into a raw SQL fragment. Doctrine's prepared-statement parameterization protects value placeholders but cannot protect SQL identifiers (column and table names) - those must be whitelisted by the application. Because InputHelper::clean() only HTML-encodes angle brackets and quote characters, it provides no defense against injection payloads that use spaces, parentheses, SQL keywords, or UNION-based constructs, all of which pass through unmodified. Unlike sibling actions in the same controller that enforce additional RBAC permission checks, this action requires only a valid authenticated session, broadening the potential attacker pool to any Mautic user regardless of role.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the only available reference is the upstream GitHub repository (https://github.com/mautic/mautic) with no linked advisory or tagged release. Organizations should monitor the Mautic GitHub repository and official security advisories for a patch. The correct permanent fix requires the Mautic development team to replace unsanitized column-name concatenation in LeadRepository::buildQueryForGetLeadsByFieldValue() with a strict whitelist check that validates the field parameter against an explicit list of valid lead column names before use in any SQL context. As an immediate compensating control, access to Mautic's AJAX routes can be restricted at the WAF or reverse-proxy layer to trusted IP ranges or known internal user segments - note this will degrade legitimate AJAX-dependent UI functionality for affected users. A WAF rule blocking requests where the field parameter contains spaces, parentheses, SQL keywords, or characters outside [a-zA-Z0-9_] can reduce exploitability with a low rate of false positives on well-formed field names. Additionally, auditing Mautic database user privileges to apply least-privilege (read-only where possible) limits the blast radius of any successful injection.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today