8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22243

CVE-2026-22243: EGroupware has SQL Injection in Nextmatch Filter Processing

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the is_int() security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22243

CVE-2026-22243:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
egroupware/egroupware	composer	< 23.1.20260113	23.1.20260113
egroupware/egroupware	composer	>= 26.0.20251208, < 26.0.20260113	26.0.20260113

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical SQL injection within EGroupware's Nextmatch widget functionality. The root cause lies in a flawed security check combined with PHP's type juggling behavior when handling JSON data. The application uses is_int() to determine if a filter key is a trusted raw SQL fragment. However, when an attacker sends a JSON payload, PHP's json_decode function automatically converts numeric string keys (e.g., "0") into integers. This causes the is_int() check in EGroupware\Api\Storage\Base::parse_search and EGroupware\Api\Db::column_data_implode to incorrectly pass, allowing attacker-supplied SQL to be concatenated directly into the database query. The exploit is triggered through the EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows method, which processes the malicious col_filter from the user's request. Therefore, all three of these functions would appear in a runtime profile during exploitation.

Vulnerable functions

EGroupware\Api\Db::column_data_implode

api/src/Db.php

This function is vulnerable because it uses `is_int()` to check if a key from a filter array should be treated as a raw SQL fragment. Due to PHP's type juggling when decoding JSON, an attacker can provide a numeric string as a key (e.g., '0'), which is converted to an integer. This bypasses the check, and the corresponding value (the attacker's SQL payload) is appended directly to the query.

EGroupware\Api\Storage\Base::parse_search

api/src/Storage/Base.php

Similar to `column_data_implode`, this function processes search criteria and uses `is_int()` to identify raw SQL parts. It is vulnerable to the same PHP type juggling issue where a numeric string key from a JSON payload is converted to an integer, allowing an attacker's unsanitized SQL payload to be added to the query.

EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows

api/src/Etemplate/Widget/Nextmatch.php

This is the primary entry point for the exploit. It receives the user-controlled `col_filter` parameter from the JSON request. This function then passes the tainted filter data to other backend methods like `parse_search`, which ultimately leads to the SQL injection. A runtime profile of the exploit would show this function at the top of the call stack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.