{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/phpok--5.4.081/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phpok:phpok:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2022-51023"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PHPOK (\u003c 5.4.081)"],"_cs_severities":["high"],"_cs_tags":["sql-injection","vulnerability","webserver"],"_cs_type":"threat","_cs_vendors":["PHPOK"],"content_html":"\u003cp\u003ePHPOK versions 4.5.000 through 5.4.080 contain an SQL injection vulnerability (CVE-2022-51023) in the sort parameter of the /api.php?c=project\u0026amp;f=index endpoint. Unauthenticated attackers can manipulate the ORDER BY clause using the extractvalue function to perform error-based data exfiltration. The Shadowserver Foundation confirmed in-the-wild exploitation of this vulnerability starting 2023-10-14.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to exfiltrate information from the backend database via error messages.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PHPOK to version 5.4.081 or later immediately.\u003c/li\u003e\n\u003cli\u003eMonitor web access logs for GET requests to /api.php containing the sort parameter populated with SQL metacharacters or XML path expressions like extractvalue.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:15:45Z","date_published":"2026-10-22T14:15:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phpok-sql-injection/","summary":"PHPOK versions 4.5.000 through 5.4.080 contain an unauthenticated SQL injection vulnerability in the sort parameter of the project index API, enabling error-based database information extraction.","title":"PHPOK: Unauthenticated SQL injection in project index API (CVE-2022-51023)","url":"https://feed.craftedsignal.io/briefs/2026-10-phpok-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - PHPOK (\u003c 5.4.081)","version":"https://jsonfeed.org/version/1.1"}