FilePress CVE-2026-8133

The Shares API endpoint must be accessible to the attacker (typically via internet if the FilePress instance is publicly exposed). No authentication is required; the vulnerability is pre-authentication. The exploitation requires the 'order' GET parameter to be passed to dzz/shares/admin.php or dzz/shares/ajax.php. No special configuration is needed - the vulnerable code path is present in default installations of FilePress up to version 2.2.0. The vulnerability is limited by: (1) database permissions (attacker can only query tables accessible to the database user), (2) character encoding restrictions in some SQL databases that may filter injected payloads, and (3) the scope of data accessible via the Filelist API response (blind SQL injection or time-based extraction may be required if results are not directly visible).

CVSS 5.5 (Medium) with AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against default configurations with low attack complexity. The CVSS vector shows limited confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L), suggesting data exfiltration or minor data modification rather than complete system compromise. However, the exploitation probability (E:P) is high, and publicly available exploit code confirms practical exploitability. The SQLi nature (CWE-89) typically enables credential theft, authentication bypass, or lateral movement depending on database permissions. Real-world risk is MEDIUM-TO-HIGH despite the moderate CVSS score because: (1) unauthenticated remote access requires no privileges; (2) public exploits lower the bar for attackers; (3) PHP-based web applications often run with database credentials embedded in code; (4) the whitelist-based patch suggests the underlying issue was severe enough to warrant explicit validation. Organizations running FilePress 2.2.0 or earlier with internet-exposed Shares API endpoints face significant data breach risk. The patch availability mitigates exploitation risk for patched instances, but unpatched legacy deployments remain critical.

An attacker sends a crafted HTTP request to the Shares Filelist API endpoint (e.g., dzz/shares/admin.php or dzz/shares/ajax.php) with a malicious SQL injection payload in the 'order' GET parameter, such as 'order=desc UNION SELECT user,password FROM admin_users--'. Because the vulnerable code only trims whitespace without validating the parameter value, the payload is directly concatenated into the SQL ORDER BY clause, allowing the attacker to extract sensitive data from the database. Publicly available exploit code from https://github.com/xiaohaiyang-ai/Web-Security-Research/ demonstrates this attack.