What is the CVSS score of CVE-2026-71292?

CVE-2026-71292 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Subrion CMS are affected by CVE-2026-71292?

Subrion CMS contains an authenticated SQL injection vulnerability in its admin panel grid sorting feature that permits database exfiltration, including administrator credentials.

How to fix or mitigate CVE-2026-71292?

Within 24 hours, audit all admin session logs and identify active administrative user accounts in affected Subrion CMS installations; change all admin account passwords immediately and document which users hold access. Within 7 days, implement Web Application Firewall (WAF) rules to block malicious sort parameters (detecting UNION, EXTRACTVALUE, or SLEEP keywords in GET parameters), restrict admin interface access to known IP ranges, and disable unused admin grid endpoints if functionality permits. Within 30 days, monitor Subrion's official security advisories for patch availability; if no patch is released within 90 days, evaluate migration to an actively maintained CMS platform with current security patches.

Subrion CMS CVE-2026-71292

EUVD-2026-53377 HIGH

SQL Injection (CWE-89)

2026-08-05 TuranSec

GHSA-p8w7-395c-pwwc

PHP SQLi Subrion Intelliants

7.2

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin panel is network-accessible (AV:N, AC:L); exploitation strictly requires a high-privilege admin session (PR:H); full database read/write/corrupt access warrants C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:49 vuln.today

CVE Published

Aug 05, 2026 - 12:38 cve.org

HIGH 7.2

DescriptionCVE.org

Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the dir (ASC/DESC) request parameter via in_array(), but falls back to the raw, attacker-supplied sort GET parameter whenever the requested key is not present in the per-controller $_gridSorting whitelist array: $column = isset($this->_gridSorting[$params['sort']]) ? ... : $params['sort'];, which is then placed into sprintf(' ORDER BY %s%s %s', $tableAlias, $column, $direction) with only backtick-quoting and no escaping. Because a backtick in the payload breaks out of the identifier context, an authenticated admin session can inject arbitrary SQL (error-based via EXTRACTVALUE, or time-based via SLEEP()) to extract database contents including administrator password hashes. Most of Subrion's ~29 admin grid controllers either define no $_gridSorting whitelist at all (e.g. pages.php, transactions.php, languages.php) or an incomplete one covering only some of their sortable columns (e.g. members.php whitelists only 1 of 7 sortable fields), making the vast majority of admin grid endpoints exploitable.

AnalysisAI

SQL injection in Subrion CMS's admin grid sorting helper exposes virtually all admin grid endpoints to authenticated SQL injection via a raw, unescaped sort GET parameter interpolated directly into an ORDER BY clause. Any valid admin session can exploit approximately 29 grid controllers - most of which carry no or incomplete column whitelists - using error-based (EXTRACTVALUE) or time-based (SLEEP) techniques to exfiltrate full database contents, including administrator password hashes. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected endpoints and straightforward technique make exploitation trivial for any attacker holding admin credentials.

Technical ContextAI

Subrion CMS (CPE: cpe:2.3:a:intelliants:subrion:*:*:*:*:*:*:*:*) is a PHP-based content management system by Intelliants. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), rooted in the _gridGetSorting() method within includes/classes/ia.base.controller.admin.php. The method uses in_array() to validate the dir parameter (ASC/DESC) but performs no equivalent validation on the sort parameter, instead falling back to the raw GET value whenever the key is absent from the per-controller $_gridSorting whitelist: $column = isset($this->_gridSorting[$params['sort']]) ? ... : $params['sort']. That unsanitized value is then passed to sprintf(' ORDER BY %s%s %s', $tableAlias, $column, $direction), where backtick-quoting alone is applied - insufficient because a backtick in the payload escapes the identifier context entirely. Of ~29 admin grid controllers, most either define no $_gridSorting array at all (pages.php, transactions.php, languages.php) or an incomplete one (members.php whitelists 1 of 7 sortable fields), meaning the vulnerable fallback branch is reachable across the vast majority of admin grid endpoints.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis - the affected version range spans all known Subrion releases per the wildcard CPE. As an immediate compensating control, restrict access to the admin panel path (/admin/) to a trusted IP allowlist via web server ACL (e.g., nginx allow/deny directives or Apache's Require ip) or upstream firewall rule; this eliminates the network attack surface entirely while preserving admin functionality for authorized users, with the trade-off that admins working from dynamic or remote IPs require VPN or similar. Additionally, enforce strong unique admin passwords and rotate existing credentials, since password hashes stored in the database may already be exposed if the application has faced prior unauthorized access. For defenders who can modify the source, the correct code-level fix is to replace the unsafe fallback in _gridGetSorting() with a strict whitelist lookup that defaults to a safe, hardcoded column name - never falling through to the raw request parameter. SQL-layer WAF rules blocking backtick characters in sort parameter values can provide partial mitigation but are bypassable and should not be relied upon as a primary control. Monitor web server logs for admin grid requests containing backtick characters, EXTRACTVALUE, SLEEP, or INFORMATION_SCHEMA references in the sort parameter as indicators of exploitation attempts.