{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28226", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.650Z", "datePublished": "2026-02-26T22:43:05.629Z", "dateUpdated": "2026-02-27T18:18:06.714Z"}, "containers": {"cna": {"title": "Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3"}, {"name": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "tags": ["x_refsource_MISC"], "url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070"}], "affected": [{"vendor": "phishingclub", "product": "phishingclub", "versions": [{"version": "< 1.30.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:43:05.629Z"}, "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}], "source": {"advisory": "GHSA-4r69-4qff-ccj3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:17:54.806954Z", "id": "CVE-2026-28226", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:18:06.714Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing", "source": {"advisory": "GHSA-4r69-4qff-ccj3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "phishingclub", "product": "phishingclub", "versions": [{"status": "affected", "version": "< 1.30.2"}]}], "references": [{"url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "name": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "name": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:43:05.629Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28226", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T18:17:54.806954Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-27T18:18:01.390Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-28226", "state": "PUBLISHED", "dateUpdated": "2026-02-26T22:43:05.629Z", "dateReserved": "2026-02-25T15:28:40.650Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:43:05.629Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phishing.club:phishing_club:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B03A9F0-8C4F-4011-9470-DE3BC9A938C1", "versionEndExcluding": "1.30.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}, {"lang": "es", "value": "Phishing Club es un framework de simulaci\u00f3n de phishing y man-in-the-middle. Antes de la versi\u00f3n 1.30.2, existe una vulnerabilidad de inyecci\u00f3n SQL autenticada en el endpoint de listado de destinatarios GetOrphaned en versiones anteriores a la v1.30.2. El endpoint construye una consulta SQL en bruto y concatena el valor sortBy controlado por el usuario directamente en la cl\u00e1usula ORDER BY sin validaci\u00f3n de lista de permitidos. Debido a que los valores desconocidos se pasan silenciosamente a trav\u00e9s de 'RemapOrderBy()', un atacante autenticado puede inyectar expresiones SQL en la cl\u00e1usula 'ORDER BY'. Este problema fue parcheado en la v1.30.2 al validar la columna de ordenaci\u00f3n contra una lista de permitidos y limpiar las asignaciones desconocidas."}], "id": "CVE-2026-28226", "lastModified": "2026-03-03T00:44:26.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-02-26T23:16:36.570", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.30.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "phishingclub", "source": "cna", "vendor": "phishingclub"}, "product": "phishingclub", "vendor": "phishingclub"}], "analysis": {"en": {"generated_at": "2026-04-16T15:55:21.137182+00:00", "value": {"mitigation_remediation": ["Upgrade Phishing Club to version 1.30.2 or later to apply the fix that validates ORDER BY input", "If an immediate upgrade is not possible, restrict access to the GetOrphaned recipient listing endpoint to only privileged accounts to reduce the attack surface", "Review and minimize database user privileges to limit the amount of data an attacker can retrieve if the vulnerability is exploited"], "summary": {"action": "Patch Immediately", "impact": "Authenticated SQL Injection (Blind) with potential data exfiltration"}, "threat_synthesis": {"affected_systems": "Phishing Club (phishingclub) versions before 1.30.2 are affected. Any deployment of the open\u2011source phishing simulation framework with a version earlier than v1.30.2 is vulnerable.", "description_and_impact": "Phishing Club exposes a blind SQL injection vulnerability in the GetOrphaned recipient listing endpoint. The endpoint builds a raw SQL query by concatenating a user\u2011controlled sortBy value directly into an ORDER BY clause, without validating the input. A user who is authenticated to the application can supply an arbitrary ORDER BY expression and forges SQL that is executed, allowing data extraction from the underlying database. This is a CWE\u201189 flaw that can compromise confidentiality of all data accessed by the system.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.5, indicating a significant risk when exploited by an authenticated attacker. EPSS indicates a very low probability of exploitation, but the possibility exists for users with valid credentials. The issue is not listed in CISA\u2019s KEV catalog. An attacker can leverage the flaw to read sensitive data if they can authenticate to the application; the impact is limited to systems where the GetOrphaned recipient listing endpoint is exposed and users have authentication."}}}}, "created": "2026-02-27T09:03:48.608445+00:00", "updated": "2026-04-16T16:00:13.882856+00:00", "vendors": ["phishingclub", "phishingclub$PRODUCT$phishingclub"]}