What is CVE-2026-71292?
In Subrion CMS, the `_gridGetSorting()` function in the admin panel sanitizes the `dir` parameter but directly uses the raw `sort` GET parameter when a whitelisted key is missing. This allows an authenticated admin user to perform SQL injection via a malicious `sort` value. Administrators should immediately update Subrion to the latest version or manually patch the `includes/classes/ia.base.controller.admin.php` file.
Azərbaycanca: Subrion CMS-in admin panelində `_gridGetSorting()` funksiyası `dir` parametrini düzgün yoxlasa da, `sort` GET parametrini birbaşa işlədir. Bu, autentifikasiya olunmuş admin istifadəçisinə malicious `sort` dəyəri ilə SQL injection hücumu etməyə imkan yaradır. Administratorlar dərhal Subrion-u son versiyaya yeniləməli və ya `includes/classes/ia.base.controller.admin.php` faylında manual patch tətbiq etməlidir.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
Is authentication required to exploit CVE-2026-71292?
Yes, this vulnerability requires an authenticated admin user, as the SQL injection attack can only be performed through the `_gridGetSorting()` function in the Subrion CMS admin panel.
What is the recommended mitigation for CVE-2026-71292?
Administrators should immediately update Subrion to the latest version or manually patch the `includes/classes/ia.base.controller.admin.php` file.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.