Code Injection in sqli (CVE-2026-36458, CVSS 9.8)

Summary

code injection in sqli (CVE-2026-36458). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical security issue was found in ChestnutCMS v1.5.10. When editing templates in the admin panel, improper handling of the content parameter allows attackers to perform unauthorized database operations or data theft remotely. A similar past incident involved large-scale data breaches due to SQL injection. Immediate upgrading or consideration of alternatives is recommended.

In ChestnutCMS v1.5.10, the content parameter in the cms_content tag is injected into an SQL query during template rendering in the admin backend, leading to SQL injection vulnerabilities. Affected versions are v1.5.10 and earlier. This allows attackers to remotely execute arbitrary SQL queries, potentially accessing sensitive data or manipulating the system. It is recommended to restrict template modifications by admin privileges and enhance input sanitization. No official patch is available yet.

❓ What is the problem

SQL injection vulnerability in the content parameter of cms_content tag during template rendering.

📍 Affected scope

Admin backend of ChestnutCMS v1.5.10 and earlier.

🔥 Severity

Critical; allows remote SQL query execution without authentication, impacting data confidentiality, integrity, and availability.

🔧 How to fix

No official patch available; recommend restricting admin template modifications and enhancing input sanitization.

🛡️ Workaround

Not specified in available data.

🔍 Detection

Monitor database access logs for unusual queries or access patterns indicative of SQL injection attempts.

Related past incidents Similar incidents extracted from past CVEs

Heartbleed

Involves critical vulnerability allowing attackers to read memory remotely without authentication.

CVE-2015-7359

SQL Injection vulnerability in the MODx Framework, similar in nature allowing remote attackers to execute arbitrary SQL code.

Drupalgeddon

Drupal core SQL injection vulnerability allowing remote code execution without authentication.

If this happens at your company Expected impact per business scenario

📌 ECサイトの管理バックエンド

規制緩和されたSQLクエリを通じて、顧客情報が盗まれる可能性があります。バナー操作や商品の変更が行われ、売上やブランドに損害を与える可能性もあります。

📌 企業のイントラネットを用いたシステム

内部データベースに不正アクセスされ、戦略や社員の機密情報が漏洩されるリスクがあります。

📌 広告媒体企業のバックエンドシステム

SQLインジェクションにより、広告クリエイティブや顧客キャンペーンデータの整合性が失われる可能性があります。

Recommended action

CMSシステムのバージョンを確認し、可能であればすぐに更新または脆弱性を一時的に回避するための措置を講じること。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'sqli' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で sqli を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Code Injection in sqli (CVE-2026-36458)