CVE-2026-94832
Pre-authentication blind SQL injection via the email field
| CVE | CVE-2026-94832 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (inc_common.php:1600) |
| CWE | CWE-89 |
| CVSS 3.1 | 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
Three things line up on PHP < 8.1. email_check() at inc_common.php:1544 validates with a regex that explicitly permits single quotes in the local part; htmlspecialchars() defaulted to ENT_COMPAT before PHP 8.1 and does not encode '; and the unescaped value is interpolated at inc_common.php:1664.
The regex also permits /, * and # — so /**/ substitutes for whitespace and # terminates. Boolean-blind extraction of the 60-character bcrypt admin hash takes roughly 2000 requests against the public form, with no account.
PHP >= 8.1 closes this as a side effect of the ENT_QUOTES default change.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94832.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch