EasyCMS 1.6 and Prior UserAction.class.php SQL Injection Vulnerability (CVE-2026-1105) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTEasyCMS versions up to and including 1.6, specifically affecting the '_order' parameter in '/UserAction.class.php'.
Unauthenticated remote attackers can manipulate the '_order' parameter to execute arbitrary SQL commands, leading to complete database compromise, sensitive data exfiltration, or potential remote code execution.
Since the vendor has not responded with an official patch, immediately deploy Web Application Firewall (WAF) rules and manually implement strict whitelist validation on the affected PHP source code.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
As the vendor has not responded to the vulnerability disclosure, no official patch is currently available. Administrators must manually remediate the vulnerability by modifying the PHP source code to enforce strict whitelist validation on the _order parameter.
// Manual remediation in /UserAction.class.php
$allowed_columns = array('id', 'username', 'created_at', 'status');
$order_input = $_GET['_order'];
if (!in_array($order_input, $allowed_columns)) {
// Default to a safe column if input is invalid
$order_input = 'id';
}2. Temporary Workaround & Hardening Configuration
Until the source code is patched, deploy virtual patching via a Web Application Firewall (WAF) or web server configuration to block malicious payloads targeting the _order parameter.
# Nginx configuration block to block common SQL injection patterns in _order
if ($request_uri ~* "_order=.*(select|union|insert|update|delete|and|or|benchmark|sleep|concat)") {
return 403;
}3. Log Audit & IoC Verification Commands
Scan your web server access logs to identify potential exploitation attempts targeting the vulnerable endpoint.
# Search access logs for suspicious SQL injection patterns in the _order parameter
grep -Ei "_order=.*(select|union|char|concat|sleep|benchmark|information_schema)" /var/log/nginx/access.log /var/log/apache2/access.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical SQL injection vulnerability (CVE-2026-1105) has been identified in EasyCMS up to version 1.6. The root cause lies within the /UserAction.class.php script, where the user-supplied input via the _order parameter is directly concatenated into SQL queries (typically within an ORDER BY clause) without sufficient sanitization or parameterization. This violates secure coding principles, leading to CWE-89 (SQL Injection) and CWE-74.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can craft malicious HTTP requests targeting /UserAction.class.php. By injecting SQL syntax (such as UNION-based or Time-based Blind payloads) into the _order parameter, the attacker bypasses application logic to execute arbitrary queries directly on the backend database. Public exploits are currently available, increasing the likelihood of active exploitation in the wild.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), the impact of this vulnerability is severe. Successful exploitation allows attackers to read, modify, or delete sensitive database records, including administrative credentials and user data. Depending on database privileges and configuration, this could escalate to local file inclusion/write operations, enabling WebShell deployment and full server takeover.
Official Vendor Advisories & References
A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argument _order leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently Asked SecOps Questions (CVE-2026-1105)
FAQQ1. How critical is CVE-2026-1105 and is it actively exploited in the wild?
CVE-2026-1105 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 0.5%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-1105?
Primary impacted vendors include easycms across easycms. Scope summary: EasyCMS versions <= 1.6 (affecting the '_order' parameter in UserAction.class.php)
Q3. What temporary mitigations or workarounds exist for CVE-2026-1105 before patching?
[Mitigation] Since the vendor has not responded with an official patch, immediately deploy Web Application Firewall (WAF) rules and manually implement strict whitelist validation on the affected PHP source code. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-1105
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (easycms)
View Category →LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory
[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Critical Security Advisory
[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10
WordPress WP_Query 'author__not_in' Parameter SQL Injection Vulnerability (CVE-2026-60137)
[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.