PT-2026-20515 · Majordomo · Majordomo

Valentin Lobstein · Publicado 2026-02-18 · Atualizado 2026-02-19 · CVE-2026-27179

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MajorDoMo (affected versions not specified)

Description MajorDoMo contains an unauthenticated SQL injection issue in the commands module. The commands search.inc.php file directly uses the $ GET['parent'] parameter in SQL queries without proper sanitization or parameterized queries. The /objects/?module=commands API endpoint allows loading arbitrary modules without authentication, calling their usual() method. This allows exploitation through time-based blind SQL injection using UNION SELECT SLEEP() syntax. Successful exploitation can lead to the extraction of admin credentials, which are stored as unsalted MD5 hashes in the users table, and subsequent access to the admin panel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-27179

Produtos afetados

Majordomo

Referências · 6

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27179 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2024322873997857191 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2024258081396576507 · Publicação no Twitter
• https://vulncheck.com/advisories/majordomo-unauthenticated-sql-injection-in-commands-module · Nota