CVE-2026-62998: CWE-20: Improper Input Validation in redaxo core
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
AI Analysis
Technical Summary
REDAXO, a PHP-based CMS, has an improper input validation vulnerability (CWE-20) in rex_list::getSortColumn() before version 5.21.2. The function accepts a sort request parameter without verifying if the requested column was registered as sortable via setColumnSortable(). An authenticated backend user can exploit this to inject an ORDER BY clause referencing unauthorized columns, enabling error-based enumeration of columns in joined tables and access to sensitive fields like rex_user.password. This vulnerability is addressed in REDAXO version 5.21.2.
Potential Impact
An authenticated backend user can exploit this vulnerability to enumerate database columns through error messages and order query results by sensitive, unselected fields such as user passwords. This may lead to partial exposure of sensitive information (confidentiality impact). There is no impact on integrity or availability reported.
Mitigation Recommendations
Upgrade REDAXO core to version 5.21.2 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-62998: CWE-20: Improper Input Validation in redaxo core
Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
CVSS v3.1
Score 4.3medium
Affected software
redaxo
core
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
REDAXO, a PHP-based CMS, has an improper input validation vulnerability (CWE-20) in rex_list::getSortColumn() before version 5.21.2. The function accepts a sort request parameter without verifying if the requested column was registered as sortable via setColumnSortable(). An authenticated backend user can exploit this to inject an ORDER BY clause referencing unauthorized columns, enabling error-based enumeration of columns in joined tables and access to sensitive fields like rex_user.password. This vulnerability is addressed in REDAXO version 5.21.2.
Potential Impact
An authenticated backend user can exploit this vulnerability to enumerate database columns through error messages and order query results by sensitive, unselected fields such as user passwords. This may lead to partial exposure of sensitive information (confidentiality impact). There is no impact on integrity or availability reported.
Mitigation Recommendations
Upgrade REDAXO core to version 5.21.2 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-14T23:10:57.032Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab3e330f7a7c54106ea7c6b
Added to database: 09/23/2026, 14:33:20 UTC
Last enriched: 09/23/2026, 14:48:09 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.