EUVD-2026-66345
GHSA-365q-7r89-28jh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover internet-facing Efence instance
-
DeliverySend crafted HTTP request to file upload endpoint
-
ExploitInject SQL payload in upload parameter
-
ExecutionEnumerate database schema
-
ImpactExtract database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the CVSS 4.0 vector confirms PR:N and the description explicitly states 'unauthenticated remote attackers can access file upload functionality.' Exploitation requires only network access to the Efence file upload endpoint over HTTP/HTTPS. No special non-default configuration is needed; the vulnerable endpoint is part of the default application surface for Efence ≤ 1.2.66 DB Ver:56. The primary limiting factor is deployment footprint: only organizations running this specific product and version are at risk. No user interaction is required on the target side. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N reflects a high-severity, network-reachable, unauthenticated attack requiring no user interaction and minimal complexity - a strong real-world risk profile. The primary confirmed impact is confidentiality (VC:H, full database read), with limited integrity impact (VI:L) and no availability impact. Despite this, the EPSS score of 0.37% at the 30th percentile suggests low observed exploitation probability in the wild to date, contrasting with the CVSS severity. SSVC corroborates this tension: exploitation status is rated 'none' currently, yet the attack is rated automatable with partial technical impact, meaning opportunistic mass scanning is realistic even before dedicated threat actors engage. Any organization running Efence ≤ 1.2.66 - from a large enterprise to a mid-sized municipal IT operation - should treat this as urgent given the zero-barrier network access and automatable nature. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers an internet-facing Efence instance via passive DNS or banner scanning, then crafts an HTTP request to the file upload endpoint containing a SQL injection payload (e.g., a UNION-based or error-based injection string). The backend SQL query incorporates the unsanitized input, and the attacker iterates over the database schema to extract credentials, configuration data, or sensitive records without ever authenticating to the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 26, 2026
SQL injection in Thinking Software Technology's Efence (versions ≤ 1.2.66 DB Ver:56) exposes full database contents to unauthenticated remote attackers via the file upload functionality. The CVSS 4.0 score of 8.8 with PR:N and AV:N confirms no credentials are required, and SSVC rates the attack as automatable. No public exploit code or CISA KEV listing exists at time of analysis, but the attack surface is low-complexity and network-accessible.
Earlier versions of this analysis (1)
SQL Injection in Efence, developed by Thinking Software Technology, allows unauthenticated remote attackers to exploit the product's file upload functionality to execute arbitrary SQL queries against the backend database. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms network-reachable exploitation requiring no credentials and low attack complexity, yielding high confidentiality impact through full database read access and limited data integrity impact. No active exploitation has been confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis.
RemediationAI
No exact patched version number is confirmed in the available input data; the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html and https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html should be consulted for vendor-released patch details. Patch availability is indicated per vendor advisory, so the primary action is to apply the vendor-supplied update immediately. As a compensating control pending patching, restrict network access to the Efence file upload endpoint via firewall rules or reverse proxy ACLs to trusted IP ranges only - this directly removes the unauthenticated network attack vector but may impact legitimate upload workflows. Additionally, enabling Web Application Firewall rules targeting SQL injection payloads on inbound requests to the upload endpoint provides detection and partial blocking, though WAF bypass is possible against determined attackers.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Efence is a product developed by Thinking Software Technology, identified by CPE cpe:2.3:a:thinking_software_technology:efence:*:*:*:*:*:*:*:*. The root cause is CWE-89 (SQL Injection): user-controlled input submitted through the file upload functionality is incorporated into SQL queries without adequate sanitization or parameterization. This allows an attacker to append or modify SQL logic, extracting arbitrary data from the underlying database. The coupling of a file upload endpoint with SQL query construction is an architectural flaw that bypasses typical authentication gates because the upload endpoint is reachable without credentials.
Know when Efence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable, unauthenticated, no user interaction; high confidentiality loss from full DB read, low integrity from file upload side-effect, no availability impact.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
2DescriptionCVE.org
Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.
Executive ViewAI
Efence versions 1.2.66 and earlier contain an unauthenticated SQL injection vulnerability in file upload functionality that exposes the entire database to remote attackers without requiring credentials. With no vendor patch available and a public attack surface requiring low complexity exploitation, organizations using affected versions face immediate risk of complete database compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to the file upload endpoint via firewall rules; (2) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns; (3) Disable file upload functionality if operationally feasible; (4) Apply strict database access controls and monitor for suspicious queries; (5) Isolate Efence database from broader network if possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Thinking Software Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8),
Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8), this vulnerability
Unauthenticated arbitrary file upload in Thinking Software Technology's EFence (versions up to and including 1.2.66, DB
Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote a
Unauthenticated SQL injection in EFence (Thinking Software Technology) exposes full database read access to remote attac
Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress
Exploit-DB