CVE-2026-92692: 
PHP 취약성 분석 및 완화

CVE-2026-92692 is a JCR-SQL2 injection vulnerability in the Sulu open-source PHP content management system (based on Symfony) that allows unauthenticated attackers to enumerate content-repository nodes or degrade availability. The flaw exists in the Smart Content QueryBuilder (src/Sulu/Component/Content/SmartContent/QueryBuilder.php), which concatenates category identifiers from the public ?categories= query parameter directly into a JCR-SQL2 WHERE clause without numeric validation. Affected versions are Sulu < 2.6.25 and Sulu >= 3.0.0, < 3.0.8. It carries a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Sulu Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), applied here to JCR-SQL2, the query language used by Sulu's Java Content Repository layer. In QueryBuilder.php, the buildCategoriesWhere() method iterates over attacker-supplied category IDs and concatenates them directly into the WHERE clause (e.g., page.[excerpt-categories] = <unsanitized_input>), whereas the equivalent tag filter already performed integer casting. Because the vulnerable parameter (?categories=) is evaluated on any public page rendering a category-filtered Smart Content block, no authentication is required. The fix, applied in commit d19c014, casts each category, tag, and audience-target-group ID to (int) before concatenation, ensuring no attacker-controlled characters can reach the query (Sulu Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to perform blind boolean-based extraction to infer the existence of and disclose content-repository nodes that should not be publicly visible, including unpublished pages. Attackers can also submit malformed or resource-intensive query fragments that cause query errors or degrade service availability. Critically, the JCR-SQL2 sink is read-only through this path, so data modification or remote code execution is not possible (Github Advisory, Sulu Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.0, and the NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable (Github Advisory). The CVE status is listed as "Deferred" and it is not present in the CISA Known Exploited Vulnerabilities catalog. Despite the low exploitation evidence, the attack requires no authentication and targets any publicly accessible page with a category-filtered Smart Content block, lowering the barrier for opportunistic exploitation.

1. Reconnaissance: Identify public-facing Sulu CMS instances running versions < 2.6.25 or >= 3.0.0, < 3.0.8. Look for pages that render Smart Content blocks with category filtering enabled (these are common on listing or news pages).
2. Identify vulnerable endpoint: Browse the target site to find a page that accepts the ?categories= query parameter and returns filtered content results, confirming the Smart Content block is active.
3. Probe for injection: Append a crafted payload to the categories parameter, e.g., ?categories[]=1 (baseline), then test ?categories[]=1) OR 1=1 -- to observe if the response changes, indicating the injection point is active.
4. Blind boolean-based enumeration: Craft boolean conditions to infer the existence of unpublished or restricted content nodes, e.g., ?categories[]=1) OR (SELECT 1 FROM [nt:base] WHERE [jcr:uuid]='<target-uuid>')=1 --, and compare true/false responses to enumerate node properties.
5. Availability degradation (optional): Submit malformed or computationally expensive query fragments via the categories parameter to trigger query errors or resource exhaustion, degrading site availability (Sulu Advisory, Patch Commit).

• Network: Unusual HTTP GET requests to public Sulu pages containing ?categories[]= parameters with non-numeric values, boolean operators (e.g., OR, AND, --), or JCR-SQL2 syntax fragments.
• Logs: Web server access logs showing repeated requests to Smart Content-enabled pages with malformed or complex categories query parameters; elevated frequency of requests from a single IP to the same page with varying categories values (indicative of blind enumeration).
• Application Logs: PHP or Symfony application logs recording JCR-SQL2 query errors or exceptions originating from QueryBuilder.php, particularly from the buildCategoriesWhere() method.
• Performance: Sudden spikes in query execution time or server CPU/memory usage correlated with requests containing complex categories payloads, suggesting resource-intensive query injection attempts.

Upgrade to Sulu 2.6.25 or 3.0.8, which cast category, tag, and audience-target-group IDs to integers before use in JCR-SQL2 queries, fully eliminating the injection vector (Sulu 2.6.25 Release, Sulu 3.0.8 Release). If an immediate upgrade is not possible, apply the fix manually by casting each ID to (int) in the buildCategoriesWhere(), buildTagsWhere(), and buildAudienceTargeting() methods in src/Sulu/Component/Content/SmartContent/QueryBuilder.php. As an additional interim measure, disable category filtering on all publicly reachable Smart Content elements until the patch is applied (Sulu Advisory).