SQL Injection Vulnerability in nemoTyrant manong

A SQL injection vulnerability (CVE-2026-111866) has been identified in the nemoTyrant manong software, affecting versions up to commit 7c9e5228e133b9267ad3a415833bc9bb53193bb4. The vulnerability resides within the 'cache/del_cache/arr2sql' function located in 'func.php'. Remote, unauthenticated attackers can leverage this flaw to manipulate SQL queries by injecting malicious payloads into parameters processed by the vulnerable function. This can lead to unauthorized data exfiltration, modification, or complete compromise of the underlying database. As the project follows a rolling release model without explicit versioning or clear remediation commit tracking, users must monitor the official repository for updates and patches.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the database backend. Depending on the database permissions configured for the application, this could result in full database compromise, unauthorized access to sensitive application data, or potential denial of service. The scope of impact is limited to environments running the affected versions of the manong software.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Implement web application firewall (WAF) rules to detect and block common SQL injection patterns targeting the 'func.php' script.
• Audit the webserver logs for unusual HTTP request parameters containing SQL metacharacters (e.g., single quotes, double dashes, OR 1=1) directed at the 'cache/del_cache/arr2sql' endpoint.
• Review the nemoTyrant manong repository regularly for security patches or maintenance commits, as the project does not provide traditional version-based security updates.
• Ensure the database user account utilized by the manong application follows the principle of least privilege to minimize the impact of a potential SQL injection compromise.