PT-2026-22214 · Unknown · Phishingclub

Raynlight · Publicado 2026-02-26 · Atualizado 2026-02-27 · CVE-2026-28226

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phishing Club versions prior to 1.30.2

Description Phishing Club is a phishing simulation and man-in-the-middle framework. An authenticated SQL injection issue exists in the GetOrphaned recipient listing endpoint. The endpoint builds a SQL query and adds the user-controlled sortBy value directly into the ORDER BY clause without proper validation. Unknown values are passed through the RemapOrderBy() function, allowing an authenticated attacker to inject SQL expressions into the ORDER BY clause. The issue was addressed by validating the order-by column against an allowlist and removing unknown mappings. The vulnerable endpoint is '/GetOrphaned'.

Recommendations Update to version 1.30.2 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-28226

GHSA-4R69-4QFF-CCJ3

Produtos afetados

Phishingclub

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28226.json · Exploit
• https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3 · Aviso do Fabricante
• https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070 · Correção
• https://twitter.com/CVEnew/status/2027466635448406320 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28226 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28226 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2027195695535407125 · Publicação no Twitter