EUVD-2026-33764
GHSA-w2ff-cx7w-3pwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Pixa Bank instance
-
DeliverySend POST to agence-ajax.php with UNION payload in 'rib'
-
ExploitEnumerate database schema via injected SELECT
-
ExecutionExtract user names, emails, phone numbers
-
ImpactExfiltrate PII for resale or phishing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or user interaction required - the agence-ajax.php endpoint accepts unauthenticated POST requests, and the 'rib' parameter is directly injectable. The only prerequisites are network reachability to the Pixa Bank 2.0 web application and the ability to send a crafted POST body (trivial with curl or the published PoC). Limiting factors: the application must be deployed and the agence-ajax.php endpoint must be exposed (it is part of the default Pixa Bank install), and the impact is bounded to data the backing database user can read (VI:L confirms no direct write/modification impact via this vector). No specific platform or non-default configuration is needed. |
| Impact | Signals converge on real, broadly exploitable risk. CVSS 4.0 of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N reflects network-reachable, low-complexity, unauthenticated exploitation, and VC:H confirms high impact to confidentiality (database disclosure) while VI:L/VA:N indicate limited integrity and no direct availability impact - consistent with a data-extraction SQLi rather than full RCE. Publicly available exploit code (Packet Storm) and a VulnCheck advisory mean weaponization is already done for attackers. EPSS is not provided in the input, and the CVE is not on CISA KEV at time of analysis, so active mass-exploitation is not confirmed; however, given trivial reproducibility and a known endpoint/parameter, defenders should treat this as imminent rather than theoretical. No conflicting signals were identified in the supplied data. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed Pixa Bank 2.0 instance, opens the Packet Storm PoC (https://packetstorm.news/files/id/220748/), and sends a POST request to /agence-ajax.php with a UNION-based payload in the 'rib' parameter to enumerate the database schema. Within minutes the attacker dumps customer names, email addresses, and phone numbers from the user table, monetizing the data via resale or phishing campaigns targeting the bank's customer base. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Unauthenticated SQL injection in Pixa Bank 2.0 allows remote attackers to exfiltrate database contents by submitting UNION-based payloads in the 'rib' parameter of the agence-ajax.php endpoint. Publicly available exploit code exists (Packet Storm) and the issue was disclosed by VulnCheck, making opportunistic exploitation likely against any internet-exposed instance. No public exploit identified at time of analysis as actively exploited in the wild (not on CISA KEV), but the trivial attack complexity and existing PoC elevate practical risk.
Earlier versions of this analysis (2)
SQL injection in Pixa Bank 2.0 allows unauthenticated remote attackers to exfiltrate sensitive customer data by injecting payloads into the 'rib' parameter of the agence-ajax.php endpoint. Publicly available exploit code exists (Packet Storm), enabling UNION-based extraction of names, emails, and phone numbers from the backing database without any user interaction or credentials.
SQL injection in Pixa Bank 2.0 enables remote unauthenticated attackers to exfiltrate sensitive customer data including names, email addresses, and phone numbers via the 'rib' parameter on the agence-ajax.php endpoint. Publicly available exploit code exists (Packet Storm advisory, VulnCheck reporting), elevating practical risk despite no current CISA KEV listing. The CVSS 8.2 reflects high confidentiality impact with limited integrity impact and no authentication requirement.
RemediationAI
No vendor-released patch identified at time of analysis; consult Pixa Studio at https://pixastudio.com/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/pixa-bank-sql-injection-via-agence-ajax-php-api for an official fix. Until a patched release is published, replace the vulnerable SQL construction in agence-ajax.php with parameterized queries (PDO prepared statements or mysqli with bound parameters) on the 'rib' parameter, and add server-side input validation that constrains 'rib' to the expected RIB account-number format (digits/length) - note this is a code change that requires a hotfix deployment. As compensating controls, place a WAF rule in front of agence-ajax.php that blocks SQL meta-characters and the keywords UNION/SELECT/SLEEP in the 'rib' field (trade-off: may break legitimate requests containing unusual characters), restrict access to agence-ajax.php to authenticated session cookies via web server ACLs or .htaccess (side effect: breaks any anonymous front-end flows that rely on this endpoint), and enable database query logging with alerts on UNION patterns to detect exploitation attempts. Rotate any credentials, tokens, or PII previously stored in the database, as data may already be exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pixa Bank by Pixa Studio is a PHP-based banking/finance web application (cpe:2.3:a:pixastudio:pixa_bank). The flaw is a classic CWE-89 Improper Neutralization of Special Elements used in an SQL Command, where user-supplied input to the 'rib' POST parameter on agence-ajax.php is concatenated into a backend SQL query without parameterization or input sanitization. Because the injection point supports UNION-based extraction, the underlying query is a SELECT that returns data to the response, letting an attacker append additional columns from arbitrary tables - a hallmark of inline string-built SQL in legacy PHP/MySQL stacks.
Know when Pixa Bank gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Pixa Bank 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract sensitive data by injecting SQL code into the 'rib' parameter. Attackers can send POST requests to the agence-ajax.php endpoint with UNION-based SQL payloads to retrieve user information including names, email addresses, and phone numbers from the database.
Executive ViewAI
Pixa Bank 2.0 contains an unauthenticated SQL injection vulnerability enabling attackers to directly exfiltrate customer database contents from any internet-exposed system. Publicly available exploit code exists, substantially elevating opportunistic attack risk against unpatched deployments. Immediate isolation of affected systems is essential to prevent customer data compromise.
No vendor-released patch identified at time of analysis. Implement network isolation via firewall rules denying internet access to agence-ajax.php, deploy Web Application Firewall rules to block SQL injection payloads targeting the 'rib' parameter, enable database activity monitoring with alerting for SQL injection patterns, implement API rate limiting on affected endpoints, and consider offline deployment of internet-exposed instances until a patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB