Craft has a SQL Injection in Element Indexes via criteria[orderBy]
Description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). This issue is patched in versions 4.16.18 and 5.8.22.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Craft CMS 4.x and 5.x are vulnerable to SQL injection via the element-indexes/get-elements endpoint due to unsanitized input in the criteria[orderBy] parameter, allowing authenticated attackers to execute arbitrary SQL.
Vulnerability
Description
Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 contain an SQL injection vulnerability in the element-indexes/get-elements endpoint. The criteria[orderBy] parameter, passed as JSON in the POST body, is not sanitized before being used in the database query. This allows an attacker to inject arbitrary SQL into the ORDER BY clause by omitting the viewState[order] parameter or setting both to the same payload [1][3].
Exploitation
Prerequisites
An attacker must have valid Control Panel access to exploit this vulnerability. No additional privileges are required beyond being able to reach and interact with the endpoint. The exploit involves intercepting the POST request to the endpoint and modifying the JSON body to include a malicious payload in the orderBy field, such as (elements.id) DESC, (SELECT SLEEP(5)) --. The server then executes the injected SQL, causing a time delay proportional to the number of affected rows [3].
Impact
Successful exploitation allows for blind SQL injection. An attacker can exfiltrate data character by character, as well as modify or destroy data (e.g., drop tables, update records, alter schema). The impact is high as the attacker can potentially read all data in the database and compromise data integrity [3].
Mitigation
The issue is patched in Craft CMS versions 4.16.18 and 5.8.22 [1][2]. Users running an affected version should update immediately. There is no mention of the vulnerability being listed in CISA KEV at this time.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
craftcms/cmsPackagist | >= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
craftcms/cmsPackagist | >= 4.0.0-RC1, < 4.16.18 | 4.16.18 |
Affected products
2Patches
12 files changed · +18 −0
CHANGELOG.md+1 −0 modified@@ -6,6 +6,7 @@ - Fixed a bug where all plugin settings were being saved to the project config, rather than just posted settings. ([craftcms/commerce#4006](https://github.com/craftcms/commerce/issues/4006)) - Fixed a bug where custom selects could be positioned incorrectly after the window was resized. ([#18179](https://github.com/craftcms/cms/issues/18179)) - Fixed an SSRF vulnerability. (GHSA-96pq-hxpw-rgh8) +- Fixed a SQL injection vulnerability. (GHSA-2453-mppf-46cj) ## 4.16.17 - 2025-12-0421
src/controllers/ElementIndexesController.php+17 −0 modified@@ -603,6 +603,23 @@ protected function elementQuery(): ElementQueryInterface $criteria['draftOf'] = filter_var($criteria['draftOf'], FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE); } } + + // Remove unsupported criteria attributes + unset( + $criteria['where'], + $criteria['orderBy'], + $criteria['indexBy'], + $criteria['select'], + $criteria['selectOption'], + $criteria['from'], + $criteria['groupBy'], + $criteria['join'], + $criteria['having'], + $criteria['union'], + $criteria['withQueries'], + $criteria['params'], + ); + Craft::configure($query, Component::cleanseConfig($criteria)); }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-2453-mppf-46cjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25495ghsaADVISORY
- github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2ghsax_refsource_MISCWEB
- github.com/craftcms/cms/releases/tag/4.16.18ghsaWEB
- github.com/craftcms/cms/releases/tag/5.8.22ghsax_refsource_MISCWEB
- github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cjghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.