CVE-2026-72550
CriticalCVSS 9.8Summary
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query, enabling stacked statement injection.
Risk Assessment
An unauthenticated attacker can read, modify, or delete the entire database, leading to complete data loss and system compromise.
Recommendation
Update Friendica to a version that properly escapes parameters. Use parameterized queries instead of direct concatenation.
Original NVD description (English source)
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.