Cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aazuracastazuracast/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 27 Sep 2026 03:05:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAzuraCast DQL Injection Vulnerability in sortOrder Parameterhttps://feed.craftedsignal.io/briefs/2026-09-azuracast-dql-injection/Sun, 27 Sep 2026 03:05:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-azuracast-dql-injection/AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw in the sortOrder API parameter, allowing attackers to exfiltrate sensitive database contents.AzuraCast versions before 0.23.8 are susceptible to a DQL injection vulnerability located within the 'sortOrder' API parameter of the 'AbstractSearchableListAction.php' file. An attacker can exploit this flaw by supplying specially crafted DQL (Doctrine Query Language) expressions via the 'sortOrder' parameter. Successful exploitation permits the attacker to bypass standard query logic, potentially leading to the unauthorized exfiltration of sensitive information from the application's database, including user credentials and station configuration settings. This vulnerability presents a significant risk to the integrity and confidentiality of the AzuraCast environment. Organizations should prioritize updating to version 0.23.8 or later to mitigate this risk.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to query and extract sensitive database contents. This could lead to the exposure of administrative user credentials and specific stream/station configuration data, potentially facilitating full application compromise or unauthorized control over broadcast settings.

Recommendation

Update all AzuraCast instances to version 0.23.8 or later immediately to patch CVE-2026-100847. Detection engineering teams should monitor web access logs for anomalous, high-entropy content or SQL/DQL-like syntax (e.g., SELECT, FROM, JOIN, WHERE) within the 'sortOrder' query parameter of API requests.

]]>highadvisoryssrfweb-applicationvulnerabilitywebserverbroken-access-controlapi-securitycredential-exposureweb-vulnerabilitycode-injectionrce