CVE-2026-94833
Unconstrained SQL injection in popup.php via extract($_REQUEST)
| CVE | CVE-2026-94833 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (popup.php:17-29) |
| CWE | CWE-89, CWE-621 |
| CVSS 3.1 | 7.5 unconditional (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — unauthenticated arbitrary SELECT over the whole schema, including the admin bcrypt hash.9.8 where the MySQL account holds FILE and secure_file_priv permits a webroot write (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — INTO OUTFILE webshell; not available on the test instance. — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
popup.php:9 is extract($_REQUEST), overwriting every local and global variable. Line 17 then builds "SELECT $field FROM \$table` WHERE $id_name = $id_value"— four of five components attacker-controlled, no character restrictions, full query control, and the result rendered back on the page. With MySQLFILE,INTO OUTFILE` writes a webshell.
Authorization is $_SESSION['contact']['access'] being truthy — and that extract() runs six lines before the check, at global scope, so the request overwrites the $_SESSION superglobal itself: &_SESSION[contact][access]=zzzz satisfies the popup.php:15 gate with no cookie and no account, and the forged value need not be a real role. This is unauthenticated. Controls: parameter absent → no output; parameter empty → no output; a real logged-in submitter without the forge → no output.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94833.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch