SQL Injection in DataLife Engine Search Module

SoftNews Media Group DataLife Engine version 18.0 contains a high-severity SQL injection vulnerability identified as CVE-2026-96604. The flaw exists within the strip_data function located in engine/modules/search.php. An unauthenticated remote attacker can exploit this by injecting malicious SQL commands into the story argument processed by the search module. This vulnerability allows for unauthorized interaction with the underlying database, potentially leading to data exfiltration or administrative compromise of the web application. Publicly available exploit material increases the risk of opportunistic targeting. The vendor has not responded to disclosure efforts, leaving installations currently exposed without an official security patch.

Impact

Successful exploitation allows remote attackers to execute arbitrary SQL queries against the DataLife Engine database. This can result in the full disclosure of sensitive user data, credential theft, or unauthorized modification of web content. Given the public availability of exploit code, organizations running DataLife Engine 18.0 are at immediate risk of automated scanning and exploitation by threat actors.

Recommendation

• Monitor web server logs for suspicious requests to engine/modules/search.php containing SQL syntax characters (e.g., UNION, SELECT, OR, --, ') within the story parameter.
• Implement Web Application Firewall (WAF) rules to inspect and sanitize input directed at the search module's story argument.
• Audit access to the database layer to identify any unexpected query patterns originating from the web application's search functionality.
• Because the vendor has not provided a patch, consider implementing temporary input validation or sanitization patches at the application level to strip SQL metacharacters from the story parameter before processing.