CVE-2026-71292
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array, which is then placed into %s with only backtick-quoting and no escaping.
Risk Assessment
The risk is the possibility of SQL injection or other attacks through manipulation of the sorting parameter, which can lead to unauthorized data access or database corruption.
Recommendation
It is recommended to update Subrion CMS to a version containing a fix or to manually add validation and escaping of sorting parameters.
Other vulnerabilities in Subrion CMS
See all- CVE-2017-15063High
There are CSRF vulnerabilities in Subrion CMS versions 4.1.x through 4.1.5 and before 4.2.0 due to a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing attacks against the query parameter to the panel/database.
- CVE-2017-6069High
Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any tag and optionally inject XSS via the tags parameter.
- CVE-2017-6068High
Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blocks/add/ module that allows an attacker to create any blocks. Additionally, the attacker can optionally inject XSS via the content parameter.
- CVE-2017-6066High
Subrion CMS version 4.0.5 has a CSRF vulnerability in the language editing module. An attacker can perform any Edit Language action and optionally inject XSS via the title parameter.
- CVE-2017-6002High
Subrion CMS version 4.0.5.10 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any blog entry and optionally inject XSS via the body parameter.
- CVE-2017-11445Critical
Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.
- CVE-2017-11444Critical
Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
- CVE-2017-6013Critical
Subrion CMS version 4.0.5.10 has an SQL injection vulnerability in the admin/database module via the query parameter.
- CVE-2017-5543Critical
In Subrion CMS version 4.0.5, a vulnerability allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
- CVE-2026-72604Medium
Path traversal vulnerability in Intelliants Subrion CMS through 4.2.1. Authenticated administrators can delete arbitrary files on the server via the admin panel file deletion endpoint, which passes a user-supplied file path directly to unlink() without sanitization.
Original NVD description (English source)
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.