Craft CMS SQL Injection Vulnerability

An unauthenticated SQL injection vulnerability affects the front end of any site using craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator.

This issue only affects MySQL/MariaDB. The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.

• Privilege escalation to administrator: The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash.
• Update to the patched versions (4.18.9 and 5.11.2) to get the fix.
• If you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation.