CVE-2026-29172: 
PHP vulnerability analysis and mitigation

CVE-2026-29172 is a SQL Injection vulnerability in Craft Commerce, an ecommerce plugin for Craft CMS, affecting the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation; because Yii2's query builder does not escape array keys, an authenticated attacker can inject arbitrary SQL into the ORDER BY clause. Affected versions are Craft Commerce 4.0.0–4.10.1 and 5.0.0–5.5.2. The vulnerability was published on March 9, 2026, and carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In OrdersController.php, the actionPurchasablesTable() method splits the sort query parameter on |, takes the first segment as a column name, and passes it directly as an array key to Yii2's orderBy() — a pattern Yii2's query builder does not sanitize. The fix, applied in commits b231b92 and e4e0f41, adds a whitelist check validating the column name against an allowed list (description, sku, price) before it is used in the query. Exploitation requires only low-level authenticated access (control panel access with order management permissions) and no user interaction, making it straightforward to trigger over the network (Github Advisory, Patch Commit b231b92).

Successful exploitation enables blind SQL injection against the underlying database, allowing an authenticated attacker to exfiltrate sensitive data character-by-character (including customer PII, transaction records, and credentials), modify or destroy database records (update, drop tables, alter schema), and potentially disrupt service availability. The impact is confined to the vulnerable Craft Commerce system's database, with high confidentiality, integrity, and availability impact on that system (Github Advisory).

A proof-of-concept exploit with concrete reproduction steps — including a specific crafted HTTP GET request and a curl command — is publicly documented in the official security advisory (Github Advisory). Feedly classifies the PoC confidence as high, noting the advisory provides actionable reproduction steps demonstrating time-based blind SQL injection via SELECT SLEEP(). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.015% (3rd percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog.

1. Authenticate: Log in to the Craft CMS control panel with an account that has Commerce order management permissions ("Manage orders" and "Edit orders").
2. Navigate to the vulnerable endpoint: Go to Commerce > Orders > Create a new order, then click "Add a line item" to trigger the purchasables table AJAX request to /index.php?p=admin/actions/commerce/orders/purchasables-table.
3. Intercept the request: Use a proxy tool (e.g., Burp Suite) to intercept the AJAX GET request, or craft a direct request using curl.
4. Inject SQL payload: Modify the sort parameter to include a SQL subquery as the column name, e.g.:

   GET /index.php?p=admin/actions/commerce/orders/purchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(2))|asc

   Or using curl:

   curl --path-as-is -k -H 'User-Agent: Mozilla/5.0' -H 'Accept: application/json' -b '<session_cookie>' 'http://target/index.php?p=admin%2Factions%2Fcommerce%2Forders%2Fpurchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(5))|asc'

5. Confirm injection: Observe a delayed response (matching the SLEEP duration), confirming time-based blind SQL injection.
6. Exfiltrate data: Use iterative blind SQL injection techniques (character-by-character extraction via conditional time delays or boolean-based responses) to extract database contents, including customer records, credentials, and transaction data (Github Advisory).

• Network: Unusual GET requests to /index.php?p=admin/actions/commerce/orders/purchasables-table with sort parameter values containing SQL syntax (e.g., SELECT, SLEEP, UNION, parentheses, or subqueries); repeated requests with slight variations in the sort parameter (indicative of iterative blind SQLi enumeration).
• Logs: Web server access logs showing requests to the purchasables-table endpoint with URL-encoded SQL keywords (%20SELECT%20, %28, SLEEP) in the sort query parameter; abnormally slow response times on that endpoint (suggesting time-based injection).
• Application Logs: Craft CMS or database error logs showing unexpected SQL syntax errors or query timeouts originating from the actionPurchasablesTable controller action.

Upgrade Craft Commerce to version 4.10.2 (for the 4.x branch) or 5.5.3 (for the 5.x branch), which add whitelist validation of the sort parameter's column name before it is passed to orderBy() (Github Advisory, Patch Commit b231b92). If immediate patching is not possible, restrict network access to the Craft CMS control panel to trusted IP addresses only, and limit the number of users with Commerce order management permissions. Monitor web server logs for suspicious sort parameter values containing SQL syntax as a detection measure.

The vulnerability was reported by researcher mHe4am and published by the Craft Commerce maintainers on March 9, 2026, with patches released simultaneously. The advisory was noted by automated CVE tracking services and vulnerability feeds shortly after publication, but no significant independent researcher commentary or media coverage has been identified beyond the official advisory.