CVE-2026-40834
HighSummary
The dash_layout.php file's saveDashboardLayout function has a remote SQL Injection vulnerability that can be exploited by a low privileged attacker. The flaw is due to improper neutralization of special elements in a SQL INSERT command, allowing for reading the entire database and inserting entries into a non-critical table.
Risk Assessment
This vulnerability can lead to a total loss of confidentiality and some loss of integrity. An attacker may gain access to sensitive information in the database.
Recommendation
It is recommended to implement proper input validation and sanitization mechanisms in the saveDashboardLayout function to prevent SQL Injection attacks. Additionally, monitoring and restricting access to critical database resources is advised.
Original NVD description (English source)
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.