PT-2026-22214 · Unknown · Phishingclub

Raynlight · Published 2026-02-26 · Updated 2026-02-27 · CVE-2026-28226

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phishing Club versions prior to 1.30.2

Description Phishing Club is a phishing simulation and man-in-the-middle framework. An authenticated SQL injection issue exists in the GetOrphaned recipient listing endpoint. The endpoint builds a SQL query and adds the user-controlled sortBy value directly into the ORDER BY clause without proper validation. Unknown values are passed through the RemapOrderBy() function, allowing an authenticated attacker to inject SQL expressions into the ORDER BY clause. The issue was addressed by validating the order-by column against an allowlist and removing unknown mappings. The vulnerable endpoint is '/GetOrphaned'.

Recommendations Update to version 1.30.2 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28226

GHSA-4R69-4QFF-CCJ3

Affected Products

Phishingclub

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28226.json · Exploit
• https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3 · Vendor Advisory
• https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070 · Patch
• https://osv.dev/vulnerability/CVE-2026-28226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28226 · Security Note
• https://twitter.com/CVEnew/status/2027466635448406320 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027195695535407125 · Twitter Post