A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449… (CVE-2026-38468)

The vulnerability is a SQL injection in the country-code lookup endpoint of GazellePW (GazellePosterWall), specifically in the tools.php script with the action get_cc. Authenticated users possessing users_view_ips privileges can exploit the ip parameter to inject arbitrary SQL commands. This could potentially lead to unauthorized data access or manipulation within the database. The vulnerability is tracked as CVE-2026-38468 and is associated with CWE-89 (SQL Injection). No patch or remediation information is provided in the available data.

The impact is limited to confidentiality as indicated by the CVSS vector (C:L/I:N/A:N). An attacker with the required privileges can execute arbitrary SQL commands, potentially exposing sensitive data. There is no indication of integrity or availability impact. Exploitation requires authentication and specific privileges, reducing the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict users_view_ips privileges to trusted users only and monitor for suspicious activity involving the tools.php?action=get_cc endpoint.