CVE-2026-25495: 
PHP vulnerability analysis and mitigation

CVE-2026-25495 is a SQL Injection vulnerability in Craft CMS affecting the element-indexes/get-elements endpoint via the criteria[orderBy] parameter in the JSON request body. It affects Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The vulnerability was discovered by researcher mHe4am, published and patched on February 9, 2026. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Craft CMS Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The ElementIndexesController.php file passed the user-supplied criteria[orderBy] parameter directly into database queries without sanitization or validation, allowing arbitrary SQL to be injected into the ORDER BY clause. An attacker can bypass internal quoting mechanisms by wrapping payloads in parentheses (e.g., (elements.id)), and can omit viewState[order] or set both parameters to the same payload to trigger the injection. The fix, applied in commit 96c60d7, removes unsupported criteria attributes — including orderBy, where, select, groupBy, join, having, and others — from the user-supplied input before passing it to the query builder (Craft CMS Advisory, Patch Commit).

Successful exploitation enables a Blind SQL Injection attack, allowing an authenticated attacker with Control Panel access to exfiltrate sensitive database contents character-by-character, modify or destroy data (e.g., drop tables, update records, alter schema), and potentially disrupt database availability. All three pillars — confidentiality, integrity, and availability — are rated High impact. Because the ORDER BY clause executes per row, time-based blind injection payloads (e.g., SLEEP(5)) are amplified by the number of rows returned, making denial-of-service via query delays feasible (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, including a ready-to-use curl command demonstrating time-based blind SQL injection. Exploitation requires only low-privilege Control Panel access and no user interaction. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.015% (3rd percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Obtain Control Panel Access: Acquire valid credentials for a Craft CMS Control Panel account (any low-privilege user with CP access is sufficient).
2. Authenticate and Retrieve CSRF Token: Log in to the Craft CMS Control Panel and capture the session cookie and CSRF token from the browser or via an authenticated request.
3. Navigate to an Element Index: Access any element index page such as /admin/users, /admin/entries, or /admin/assets to trigger the vulnerable endpoint.
4. Intercept the POST Request: Use a proxy tool (e.g., Burp Suite) to intercept the POST request sent to /index.php?p=admin/actions/element-indexes/get-elements.
5. Inject Malicious Payload: Modify the JSON body to include a crafted criteria[orderBy] value, omitting viewState[order]. Example payload for time-based blind injection:

{"context":"index","elementType":"craft\\elements\\User","source":"*","baseCriteria":{"siteId":1},"criteria":{"limit":100,"orderBy": "(elements.id) DESC, (SELECT SLEEP(5)) --"},"viewState":{"static":false}}

6. Confirm Injection: Observe a response delay proportional to the number of rows multiplied by the sleep duration, confirming blind SQL injection.
7. Exfiltrate Data: Use character-by-character extraction techniques (e.g., IF(SUBSTRING(...)=char,SLEEP(x),0)) to enumerate database contents, including credentials, user data, or configuration secrets (Craft CMS Advisory).

• Network: Unusual POST requests to /index.php?p=admin/actions/element-indexes/get-elements with JSON bodies containing SQL keywords (SLEEP, SELECT, DROP, UPDATE, --) in the criteria[orderBy] field; abnormally slow HTTP responses from the Craft CMS admin panel suggesting time-based injection.
• Logs: Web server access logs showing repeated POST requests to the element-indexes/get-elements endpoint with large or unusual JSON payloads; database slow query logs recording ORDER BY clauses containing subqueries or SQL functions like SLEEP().
• Application Logs: Craft CMS application logs (craft/storage/logs/) showing unexpected query errors or anomalous query patterns originating from the element index controller.
• Process: Database process list showing long-running queries with SLEEP() or complex subqueries in ORDER BY clauses initiated by the Craft CMS database user (Craft CMS Advisory).

Craft CMS has released patched versions 4.16.18 (for the 4.x branch) and 5.8.22 (for the 5.x branch), which remove unsupported and dangerous criteria attributes — including orderBy — from user-supplied input before query execution. Administrators should upgrade immediately to one of these versions. As a temporary workaround until patching is possible, restrict Control Panel access to trusted administrators only and monitor database query logs for suspicious SQL patterns in ORDER BY clauses (Craft CMS Advisory, Release 5.8.22, Patch Commit).

The vulnerability was reported by researcher mHe4am and promptly addressed by Craft CMS maintainer Brandon Kelly, who merged the fix on February 9, 2026 — the same day of disclosure. The advisory was reviewed and published to the GitHub Advisory Database on the same day, reflecting a coordinated disclosure process. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database aggregation (Craft CMS Advisory).