PT-2026-20515 · Majordomo · Majordomo

Valentin Lobstein · Published 2026-02-18 · Updated 2026-02-19 · CVE-2026-27179

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MajorDoMo (affected versions not specified)

Description MajorDoMo contains an unauthenticated SQL injection issue in the commands module. The commands search.inc.php file directly uses the $ GET['parent'] parameter in SQL queries without proper sanitization or parameterized queries. The /objects/?module=commands API endpoint allows loading arbitrary modules without authentication, calling their usual() method. This allows exploitation through time-based blind SQL injection using UNION SELECT SLEEP() syntax. Successful exploitation can lead to the extraction of admin credentials, which are stored as unsalted MD5 hashes in the users table, and subsequent access to the admin panel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27179

Affected Products

Majordomo

References · 6

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27179 · Security Note
• https://twitter.com/VulmonFeeds/status/2024322873997857191 · Twitter Post
• https://twitter.com/CVEnew/status/2024258081396576507 · Twitter Post
• https://vulncheck.com/advisories/majordomo-unauthenticated-sql-injection-in-commands-module · Note