8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25495

CVE-2026-25495: Craft has a SQL Injection in Element Indexes via criteria[orderBy]

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). This issue is patched in versions 4.16.18 and 5.8.22.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25495

CVE-2026-25495:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.21	5.8.22
craftcms/cms	composer	>= 4.0.0-RC1, <= 4.16.17	4.16.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection flaw within the ElementIndexesController.php file of Craft CMS. The analysis of the provided patch commit 96c60d775c644ff0a0276da52fe29e11d4cd38d2 reveals that the elementQuery function was modified to prevent this vulnerability. The endpoint /admin/actions/element-indexes/get-elements is handled by the actionGetElements method in this controller, which in turn calls elementQuery to construct the database query. The vulnerability description and the PoC confirm that the criteria[orderBy] parameter in the JSON body of the POST request is the injection vector. The patch addresses the vulnerability by adding code to the elementQuery function to remove the orderBy key from the user-supplied $criteria array before it is used to build the SQL query. This directly pinpoints craft\controllers\ElementIndexesController::elementQuery as the function where the vulnerable code existed and was subsequently patched. During exploitation, this function would process the malicious orderBy parameter, making it a key indicator in a runtime profile.

Vulnerable functions

craft\controllers\ElementIndexesController::elementQuery

src/controllers/ElementIndexesController.php

The `elementQuery` function is responsible for building an element query based on request parameters. The vulnerability existed because the `criteria[orderBy]` parameter, which is user-controlled, was passed into the query configuration without sanitization. This allowed an attacker to inject arbitrary SQL into the `ORDER BY` clause. The patch fixes this by explicitly unsetting the `orderBy` key (among others) from the `$criteria` array before it is used to configure the query, thus preventing the malicious input from affecting the database query.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.