« Volver al listado

CVE-2026-28226

Estado: AnalizadaMedia (6.5)—

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phishing.club — Phishing Club

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28226",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28226",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T18:17:54.806954Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "phishingclub",
          "product": "phishingclub",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.30.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T23:16:36.570",
  "references": [
    {
      "url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."
    },
    {
      "lang": "es",
      "value": "Phishing Club es un framework de simulación de phishing y man-in-the-middle. Antes de la versión 1.30.2, existe una vulnerabilidad de inyección SQL autenticada en el endpoint de listado de destinatarios GetOrphaned en versiones anteriores a la v1.30.2. El endpoint construye una consulta SQL en bruto y concatena el valor sortBy controlado por el usuario directamente en la cláusula ORDER BY sin validación de lista de permitidos. Debido a que los valores desconocidos se pasan silenciosamente a través de 'RemapOrderBy()', un atacante autenticado puede inyectar expresiones SQL en la cláusula 'ORDER BY'. Este problema fue parcheado en la v1.30.2 al validar la columna de ordenación contra una lista de permitidos y limpiar las asignaciones desconocidas."
    }
  ],
  "lastModified": "2026-06-17T10:28:22.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phishing.club:phishing_club:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B03A9F0-8C4F-4011-9470-DE3BC9A938C1",
              "versionEndExcluding": "1.30.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}