PHPOK: Unauthenticated SQL injection in project index API (CVE-2022-51023)
PHPOK versions 4.5.000 through 5.4.080 contain an unauthenticated SQL injection vulnerability in the sort parameter of the project index API, enabling error-based database information extraction.
CVE search metadata
CVE search record: CVE-2022-51023. Severity: high. CVSS: 8.2. KEV: no. Product: PHPOK (< 5.4.081). Brief: PHPOK: Unauthenticated SQL injection in project index API (CVE-2022-51023). Brief link: https://feed.craftedsignal.io/briefs/2026-10-phpok-sql-injection/
Triage facts
Revision 1- Applicability
- PHPOK (< 5.4.081)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 14:15 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
PHPOK versions 4.5.000 through 5.4.080 contain an SQL injection vulnerability (CVE-2022-51023) in the sort parameter of the /api.php?c=project&f=index endpoint. Unauthenticated attackers can manipulate the ORDER BY clause using the extractvalue function to perform error-based data exfiltration. The Shadowserver Foundation confirmed in-the-wild exploitation of this vulnerability starting 2023-10-14.
Impact
Successful exploitation allows unauthenticated attackers to exfiltrate information from the backend database via error messages.
Recommendation
- Upgrade PHPOK to version 5.4.081 or later immediately.
- Monitor web access logs for GET requests to /api.php containing the sort parameter populated with SQL metacharacters or XML path expressions like extractvalue.
Immediate actions
Upgrade PHPOK to 5.4.081 or later
Mitigations
Upgrade to version 5.4.081
CVE-2022-51023
Detection coverage 1
Detects CVE-2022-51023 Exploitation - SQL Injection in PHPOK sort parameter
highDetects GET requests to the PHPOK project index API with suspicious SQL injection payloads in the sort parameter using error-based XML extraction functions.
Detection queries are available on the platform. Get full rules →