CVE-2026-54368: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54368 is a SQL injection vulnerability in Gladinet CentreStack affecting all versions before 17.4. The flaw resides in the GladDBFiles.SearchEx() and SearchExUnder() methods, allowing authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint, ultimately enabling remote code execution. It was published on July 30, 2026, with a patch available in version 17.4. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically the unsanitized interpolation of the Field parameter from the x-glad-filter request header directly into SQL query strings within GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can craft a malicious x-glad-filter header value targeting the jsondir API endpoint to inject arbitrary SQL. By leveraging PostgreSQL's lo_from_bytea() and lo_export() functions, the attacker can write arbitrary files to the server filesystem, escalating the SQL injection to remote code execution. Exploitation requires low privileges (any authenticated user) and no user interaction (GitHub Advisory, VulnCheck).

Successful exploitation grants an authenticated attacker full control over the CentreStack server, with high impact to confidentiality, integrity, and availability. Attackers can read sensitive data from the database, write arbitrary files to the server filesystem (including web shells), and achieve remote code execution under the application's service account. This could enable lateral movement within the network, persistent access, and complete compromise of hosted data and connected systems (GitHub Advisory, VulnCheck).

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.4 using network scanning tools or Shodan. Confirm the jsondir API endpoint is accessible.
2. Authentication: Obtain valid credentials for any CentreStack user account (low-privilege access is sufficient).
3. Craft malicious request: Construct an HTTP request to the jsondir API endpoint with a crafted x-glad-filter header. Inject SQL syntax into the Field parameter, e.g., {"Field": "name; <SQL_PAYLOAD>--"}, to break out of the intended query context.
4. Write file via PostgreSQL functions: Use PostgreSQL's lo_from_bytea() to load arbitrary binary content (e.g., a web shell) into a large object, then use lo_export() to write it to a known web-accessible path on the server filesystem.
5. Achieve remote code execution: Access the written web shell via HTTP to execute arbitrary OS commands on the CentreStack server, enabling full system compromise (GitHub Advisory, VulnCheck).

• Network: HTTP requests to the jsondir API endpoint containing unusual or encoded x-glad-filter headers with SQL syntax (e.g., semicolons, SQL keywords like SELECT, INSERT, lo_from_bytea, lo_export).
• Logs: Web server or application logs showing repeated or anomalous requests to the jsondir endpoint from authenticated sessions; PostgreSQL logs recording unexpected large object operations (lo_from_bytea, lo_export) or file write activity.
• File System: Unexpected new files (especially .aspx, .php, or script files) appearing in web-accessible directories of the CentreStack installation; files with recent modification timestamps inconsistent with normal application updates.
• Process: Unusual child processes spawned by the CentreStack application process (e.g., cmd.exe, powershell.exe, bash) indicating web shell execution.

Upgrade CentreStack to version 17.4 or later, which contains the fix for this vulnerability. If immediate patching is not feasible, restrict network access to the jsondir API endpoint using firewall rules or reverse proxy ACLs, and limit access to trusted, known-good IP addresses. Additionally, monitor API logs for suspicious x-glad-filter request headers containing SQL syntax as a detection measure until patching is complete (GitHub Advisory, VulnCheck).