CVE-2026-31858: 
PHP vulnerability analysis and mitigation

CVE-2026-31858 is a blind SQL injection vulnerability in Craft CMS's ElementSearchController::actionSearch() endpoint, classified as a bypass of a previously issued fix (GHSA-2453-mppf-46cj). It affects Craft CMS versions 5.0.0-RC1 through 5.9.8 and was disclosed on March 9, 2026, with a patch released in version 5.9.9. Any authenticated control panel user — without administrator privileges — can inject arbitrary SQL via criteria[where], criteria[orderBy], or other query properties to extract the full database contents via boolean-based blind injection. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Craft CMS Advisory).

The root cause is an incomplete fix: when GHSA-2453-mppf-46cj patched the ElementIndexesController by adding unset() protection via ElementHelper::cleanseQueryCriteria(), the same sanitization was never applied to the ElementSearchController (CWE-89). As a result, user-supplied criteria parameters — including criteria[orderBy] and criteria[where] — are passed directly to the database query builder without sanitization, allowing injection into the SQL ORDER BY or WHERE clauses. The fix, committed in e1a3dd6, adds a call to ElementHelper::cleanseQueryCriteria($criteria) before Craft::configure($query, ...) is invoked in actionSearch(). The attack requires only a valid authenticated session to the Craft CMS control panel and no additional privileges (Craft CMS Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to exfiltrate the entire database contents character-by-character using boolean-based blind SQL injection, exposing sensitive data such as user credentials, content, and configuration. Integrity is also at risk, as an attacker could modify or destroy database records, drop tables, or alter schema. Availability may be impacted through resource exhaustion via time-based injection techniques (e.g., repeated SLEEP() calls). The scope is limited to the vulnerable Craft CMS system's database, but the full confidentiality, integrity, and availability of that database are at high risk (Github Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043% (13th percentile), indicating a low near-term exploitation probability. However, the low privilege requirement (any authenticated control panel user) and the existence of a closely related prior advisory (GHSA-2453-mppf-46cj) with a documented PoC increase the practical risk for organizations with broad control panel access (Github Advisory).

1. Authenticate: Obtain valid credentials for any Craft CMS control panel user account (admin privileges are not required).
2. Identify the target endpoint: Locate the ElementSearchController::actionSearch() endpoint, typically accessible at /index.php?p=admin/actions/element-search/search on the target Craft CMS instance.
3. Craft the malicious request: Intercept or construct a POST request to the search endpoint, injecting a SQL payload into the criteria[orderBy] or criteria[where] parameter. For example, using a time-based payload: criteria[orderBy]=(elements.id) DESC, (SELECT SLEEP(5)) --
4. Confirm injection: Observe a delayed response confirming the SQL payload executed. The delay will be proportional to the number of rows returned multiplied by the sleep interval.
5. Extract data via boolean-based blind injection: Iteratively craft payloads that evaluate true/false conditions to extract database contents character-by-character (e.g., using IF(SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a', SLEEP(2), 0)).
6. Exfiltrate or manipulate data: Use automated tools (e.g., sqlmap with a captured request) to systematically dump tables, extract credentials, or modify records (Craft CMS Advisory, Prior Advisory).

• Network: Unusual or repeated POST requests to /index.php?p=admin/actions/element-search/search with criteria[orderBy] or criteria[where] parameters containing SQL keywords (e.g., SLEEP, SELECT, IF, SUBSTRING, --).
• Logs: Web server or application access logs showing requests to the element-search/search action with abnormally long or encoded query parameters; time-delayed responses (e.g., responses taking multiples of a fixed interval) from the search endpoint.
• Database: Unusual or unexpected query patterns in database slow query logs, particularly queries with SLEEP(), nested SELECT statements, or boolean conditions in ORDER BY or WHERE clauses originating from the application user.
• Application: Craft CMS application logs (storage/logs/) showing repeated or anomalous calls to ElementSearchController::actionSearch() from a single authenticated user account.

The primary remediation is to upgrade Craft CMS to version 5.9.9 or later, which applies ElementHelper::cleanseQueryCriteria() to sanitize user-supplied criteria parameters in ElementSearchController::actionSearch() before they are passed to the query builder (Patch Commit, Github Advisory). If immediate patching is not possible, restrict control panel access to only trusted, known users and enforce strong authentication (e.g., MFA). Additionally, monitor database and web server logs for anomalous SQL patterns in requests to the element-search/search endpoint.

The vulnerability was reported by security researcher "Neosprings" and published by the Craft CMS maintainers on March 9, 2026. It was noted in the community as a bypass of a prior fix (GHSA-2453-mppf-46cj), highlighting the risk of incomplete patch coverage across similar controllers. Brief mentions appeared on social platforms including Bluesky and automated CVE tracking feeds shortly after disclosure (Github Advisory).