FilePress EUVD-2026-78269

The Publish Module search endpoint (dzz/publish/search.php) must be publicly accessible - this is the default configuration for FilePress deployments since Publish is designed for public content sharing. No authentication is required (PR:N confirmed by CVSS 4.0 vector). No special client-side interaction is needed. Exploitation is limited by the ORDER BY injection context, which restricts attacker capability to primarily read-based blind extraction rather than direct arbitrary write or command execution. Victims must be running FilePress 3.0.0 or 3.0.1 on a PHP/MySQL stack. No exploitation is possible if the search endpoint is blocked by network controls or the application is not deployed.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N rates this at 5.5 with low confidentiality, integrity, and availability impact - reflecting that ORDER BY injection is more constrained than a full UNION-based or stacked-query SQLi. Despite the moderate score, the combination of network-accessible unauthenticated attack surface and a publicly available PoC (GitHub issue #74) elevates practical risk. EPSS data was not provided, but the PoC availability means exploitation requires minimal attacker capability. The vendor has not responded to the disclosure, meaning no patch exists and the vulnerability remains open. Real-world risk is bounded primarily by FilePress's limited deployment footprint rather than by technical barriers to exploitation. No KEV listing exists, and no active exploitation campaigns have been confirmed at time of analysis.

An attacker sends a crafted HTTP GET or POST request to the publicly accessible dzz/publish/search.php endpoint with a malicious orderby parameter value such as a boolean expression or time-delay payload (e.g., IF(1=1,SLEEP(5),0)). By observing response timing differences, the attacker conducts blind time-based SQL injection to enumerate database schema and extract sensitive data such as credentials or file metadata. A public PoC is available at https://github.com/zyx0814/FilePress/issues/74, lowering the skill threshold required.