CVE-2026-29174: 
PHP vulnerability analysis and mitigation

CVE-2026-29174 is a SQL Injection vulnerability in Craft Commerce, an ecommerce plugin for Craft CMS, affecting versions 5.0.0 through 5.5.2. The flaw exists in the inventory levels table data endpoint, where the sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without validation or sanitization. It was disclosed on March 9, 2026, by researcher mHe4am via the GitHub Security Advisory GHSA-pmgj-gmm4-jh6j, and patched in version 5.5.3. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) and a CVSS v3.1 base score of 8.8 (High) (Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), classified as a blind SQL injection. In src/controllers/InventoryController.php, the actionInventoryLevelsTableData() method accepted user-supplied sort[0][sortField] and sort[0][direction] parameters and passed them directly to an addOrderBy() database query clause without any allowlist validation or parameterization. The fix, applied in commit 094d69d, introduced an explicit allowlist check — validating direction against ['asc', 'desc'] and sortField against a fixed set of permitted column names — nullifying both values if they fail validation. Exploitation requires the attacker to be authenticated with control panel access and the "Manage inventory stock levels" permission (Github Advisory, Patch Commit).

Successful exploitation enables a blind SQL injection attack against the underlying database, allowing an authenticated attacker to exfiltrate sensitive data character-by-character using time-based techniques, modify or destroy database records, drop tables, update records, or alter the database schema. The full database — including customer data, order history, credentials, and configuration — is at risk of compromise. Confidentiality, integrity, and availability of the vulnerable system are all rated High (Github Advisory).

A proof-of-concept exploit is publicly documented in the official GitHub Security Advisory, including specific crafted URLs and curl commands demonstrating time-based blind SQL injection via the sleep(2) payload. The EPSS score is approximately 0.015% (3rd percentile), indicating a currently low probability of widespread exploitation. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory).

1. Obtain authenticated access: Acquire credentials for a Craft CMS control panel account with the permissions "Access the control panel," "Access Craft Commerce," and "Manage inventory stock levels."
2. Navigate to the vulnerable endpoint: Log in and navigate to Commerce > Inventory to trigger a legitimate sort request, or directly target the endpoint /index.php?p=admin/actions/commerce/inventory/inventory-levels-table-data.
3. Intercept and modify the request: Use a proxy tool (e.g., Burp Suite) to intercept the GET request when clicking a sortable column header (e.g., "SKU"), or craft a direct request.
4. Inject the SQL payload: Append a time-based blind SQL injection payload to the sort[0][sortField] or sort[0][direction] parameter:

   GET /index.php?p=admin/actions/commerce/inventory/inventory-levels-table-data&sort[0][sortField]=sku,sleep(2)&sort[0][direction]=asc&inventoryLocationId=1&containerId=%23inventory-levels

   Or using curl:

   curl --path-as-is -k -H 'Accept: application/json, text/plain, */*' -b '<session_cookie>' 'http://target.local/index.php?p=admin/actions/commerce/inventory/inventory-levels-table-data&sort%5b0%5d%5bsortField%5d=sku,sleep(2)&sort%5b0%5d%5bdirection%5d=asc&page=1&per_page=25&inventoryLocationId=1&containerId=%23inventory-levels'

5. Confirm injection: Observe a ~2-second delay in the server response, confirming the SQL payload executed.
6. Exfiltrate data: Use time-based blind SQL injection techniques (e.g., binary search with IF() and sleep()) to extract database contents character-by-character, or use tools like sqlmap with the session cookie against the vulnerable endpoint (Github Advisory).

• Network: Unusual GET requests to /index.php?p=admin/actions/commerce/inventory/inventory-levels-table-data containing SQL keywords or functions (e.g., sleep, IF, BENCHMARK, UNION, SELECT) in sort[0][sortField] or sort[0][direction] query parameters; repeated requests to this endpoint with varying payloads suggesting automated enumeration.
• Logs: Web server access logs showing requests to the inventory table data endpoint with encoded characters (%2c, %28, %29) in sort parameters; application logs showing abnormal query execution times or database errors originating from the InventoryController.
• Application Behavior: Noticeably delayed HTTP responses (e.g., 2+ seconds) from the inventory endpoint that correlate with time-based SQL injection probing; unexpected database errors logged in Craft CMS application logs.

Upgrade Craft Commerce to version 5.5.3 or later, which introduces allowlist validation for both sort[0][sortField] and sort[0][direction] parameters in InventoryController.php. If an immediate upgrade is not feasible, restrict access to the Commerce Inventory section to the minimum number of trusted administrators and monitor for anomalous sort parameter values. The fix is available via Composer: composer require craftcms/commerce:^5.5.3 (Github Advisory, Patch Commit).