CVE-2026-27179 describes an unauthenticated SQL injection vulnerability in MajorDoMo's commands module. The commands_search.inc.php file interpolates the $_GET['parent'] parameter directly into SQL queries without sanitization or use of parameterized queries. The commands module can be loaded without authentication via the /objects/?module=commands endpoint, which loads arbitrary modules and calls their usual() method. This flaw enables time-based blind SQL injection attacks using UNION SELECT SLEEP() syntax. Since admin passwords are stored as unsalted MD5 hashes in the users table, successful exploitation allows attackers to extract credentials and gain admin panel access.

An attacker can exploit this vulnerability without authentication to perform SQL injection attacks, potentially extracting sensitive data including admin credentials stored as unsalted MD5 hashes. This leads to unauthorized administrative access to the MajorDoMo system, compromising its integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /objects/?module=commands endpoint and consider implementing web application firewall rules to detect and block SQL injection attempts targeting the 'parent' parameter.