Skip to content
Threat Feed
Subscribe
high threat exploited

SQL Injection in ESAFENET CDG

A publicly exploitable SQL injection vulnerability in ESAFENET CDG allows unauthenticated remote attackers to execute arbitrary database queries via the keyid parameter.

A high-severity SQL injection vulnerability has been identified in ESAFENET CDG software, affecting versions up to 20260615. The flaw is located within an undisclosed function of the file /CDGServer3/ukey/usbkey;logindojojs. An unauthenticated, remote attacker can manipulate the keyid argument to inject malicious SQL commands, potentially resulting in unauthorized data access or modification. Publicly available exploit code exists, increasing the risk of active exploitation. The vendor has not yet released a patch or responded to disclosure efforts. Defenders should treat this as an immediate risk to any exposed CDG server deployments.

Attack Chain

  1. Attacker performs reconnaissance to identify internet-facing ESAFENET CDG servers.
  2. Attacker crafts an HTTP GET or POST request targeting the /CDGServer3/ukey/usbkey;logindojojs endpoint.
  3. Attacker injects malicious SQL syntax into the keyid parameter, bypassing input sanitization.
  4. The web server process passes the unsanitized parameter to the backend database engine.
  5. The database executes the injected commands within the context of the service account.
  6. Attacker extracts sensitive data from the underlying database or modifies application records to maintain persistence or escalate privileges.

Impact

Successful exploitation allows unauthenticated remote attackers to gain unauthorized access to data stored within the CDG database. Depending on the database configuration, this may result in complete data exfiltration, modification, or potential lateral movement within the network. This vulnerability poses a significant risk to organizations using CDG for sensitive document or data protection.

Recommendation

Prioritize the identification of all internet-facing ESAFENET CDG installations. Given the lack of a vendor patch, implement strict perimeter filtering to restrict access to the /CDGServer3/ukey/usbkey;logindojojs path. Deploy WAF rules to inspect and block incoming HTTP requests containing SQL injection patterns in the keyid parameter. Monitor web server access logs for anomalous requests to the identified vulnerable endpoint.

References

Immediate actions

Deploy WAF rule to block requests containing SQL injection strings to the vulnerable endpoint.

SOC 24h

Mitigations

Restrict external network access to the CDG server.

immediate IT Operations

CVE-2026-18859

Detection coverage 1

Detect CVE-2026-18859 Exploitation - SQL Injection via keyid

high

Detects exploitation attempts against the ESAFENET CDG endpoint by looking for common SQL injection markers in the keyid parameter.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →