{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28226", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.650Z", "datePublished": "2026-02-26T22:43:05.629Z", "dateUpdated": "2026-02-27T18:18:06.714Z"}, "containers": {"cna": {"title": "Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3"}, {"name": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "tags": ["x_refsource_MISC"], "url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070"}], "affected": [{"vendor": "phishingclub", "product": "phishingclub", "versions": [{"version": "< 1.30.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:43:05.629Z"}, "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}], "source": {"advisory": "GHSA-4r69-4qff-ccj3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:17:54.806954Z", "id": "CVE-2026-28226", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:18:06.714Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing", "source": {"advisory": "GHSA-4r69-4qff-ccj3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "phishingclub", "product": "phishingclub", "versions": [{"status": "affected", "version": "< 1.30.2"}]}], "references": [{"url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "name": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "name": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:43:05.629Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28226", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T18:17:54.806954Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-27T18:18:01.390Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-28226", "state": "PUBLISHED", "dateUpdated": "2026-02-26T22:43:05.629Z", "dateReserved": "2026-02-25T15:28:40.650Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:43:05.629Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phishing.club:phishing_club:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B03A9F0-8C4F-4011-9470-DE3BC9A938C1", "versionEndExcluding": "1.30.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}, {"lang": "es", "value": "Phishing Club es un framework de simulaci\u00f3n de phishing y man-in-the-middle. Antes de la versi\u00f3n 1.30.2, existe una vulnerabilidad de inyecci\u00f3n SQL autenticada en el endpoint de listado de destinatarios GetOrphaned en versiones anteriores a la v1.30.2. El endpoint construye una consulta SQL en bruto y concatena el valor sortBy controlado por el usuario directamente en la cl\u00e1usula ORDER BY sin validaci\u00f3n de lista de permitidos. Debido a que los valores desconocidos se pasan silenciosamente a trav\u00e9s de 'RemapOrderBy()', un atacante autenticado puede inyectar expresiones SQL en la cl\u00e1usula 'ORDER BY'. Este problema fue parcheado en la v1.30.2 al validar la columna de ordenaci\u00f3n contra una lista de permitidos y limpiar las asignaciones desconocidas."}], "id": "CVE-2026-28226", "lastModified": "2026-03-03T00:44:26.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-02-26T23:16:36.570", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}