CVE-2020-26138

Vulnerability

In SilverStripe versions through 4.6.0-rc1, a FormField with square brackets in the field name (e.g., field[]) causes the framework to skip validation for that field. This occurs because PHP interprets the field name as an array, and the validation logic does not properly handle array-type field names [1][2].

Exploitation

An attacker can craft a form submission where a field name includes square brackets, bypassing server-side validation. No authentication is required if the form is publicly accessible; otherwise, the attacker needs to submit a form they have access to. The attacker simply appends [] to the field name in the HTTP request payload [2].

Impact

Successful exploitation allows the attacker to submit invalid or malicious data that would otherwise be rejected by validation. This could lead to data corruption, injection attacks, or other unintended behavior depending on the form's processing logic. The confidentiality and availability of the system are not directly compromised, but integrity of submitted data is undermined [1][2].

Mitigation

SilverStripe has released a fix in versions after 4.6.0-rc1. Users should upgrade to SilverStripe 4.6.0 or later. As a workaround, developers can manually validate fields with square brackets in custom code or ensure that field names do not contain square brackets [2]. No known KEV listing.