CVE-2026-28226

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070	Patch
https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phishing.club:phishing_club:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-26 23:16

Updated : 2026-06-17 10:28

NVD link : CVE-2026-28226

Mitre link : CVE-2026-28226

CVE.ORG link : CVE-2026-28226

JSON object : View

Products Affected

phishing.club

phishing_club

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-28226", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28226", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T18:17:54.806954Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "phishingclub", "product": "phishingclub", "versions": [{"status": "affected", "version": "< 1.30.2"}]}]}], "published": "2026-02-26T23:16:36.570", "references": [{"url": "https://github.com/phishingclub/phishingclub/commit/c7e666da9a71cd519f317cbf67ade10068a33070", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/phishingclub/phishingclub/security/advisories/GHSA-4r69-4qff-ccj3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings."}, {"lang": "es", "value": "Phishing Club es un framework de simulaci\u00f3n de phishing y man-in-the-middle. Antes de la versi\u00f3n 1.30.2, existe una vulnerabilidad de inyecci\u00f3n SQL autenticada en el endpoint de listado de destinatarios GetOrphaned en versiones anteriores a la v1.30.2. El endpoint construye una consulta SQL en bruto y concatena el valor sortBy controlado por el usuario directamente en la cl\u00e1usula ORDER BY sin validaci\u00f3n de lista de permitidos. Debido a que los valores desconocidos se pasan silenciosamente a trav\u00e9s de 'RemapOrderBy()', un atacante autenticado puede inyectar expresiones SQL en la cl\u00e1usula 'ORDER BY'. Este problema fue parcheado en la v1.30.2 al validar la columna de ordenaci\u00f3n contra una lista de permitidos y limpiar las asignaciones desconocidas."}], "lastModified": "2026-06-17T10:28:22.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phishing.club:phishing_club:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B03A9F0-8C4F-4011-9470-DE3BC9A938C1", "versionEndExcluding": "1.30.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}