PHPOK (< 5.4.081) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/phpok--5.4.081/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:15:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPHPOK: Unauthenticated SQL injection in project index API (CVE-2022-51023)https://feed.craftedsignal.io/briefs/2026-10-phpok-sql-injection/Thu, 22 Oct 2026 14:15:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-phpok-sql-injection/PHPOK versions 4.5.000 through 5.4.080 contain an unauthenticated SQL injection vulnerability in the sort parameter of the project index API, enabling error-based database information extraction.PHPOK versions 4.5.000 through 5.4.080 contain an SQL injection vulnerability (CVE-2022-51023) in the sort parameter of the /api.php?c=project&f=index endpoint. Unauthenticated attackers can manipulate the ORDER BY clause using the extractvalue function to perform error-based data exfiltration. The Shadowserver Foundation confirmed in-the-wild exploitation of this vulnerability starting 2023-10-14.

Impact

Successful exploitation allows unauthenticated attackers to exfiltrate information from the backend database via error messages.

Recommendation

  • Upgrade PHPOK to version 5.4.081 or later immediately.
  • Monitor web access logs for GET requests to /api.php containing the sort parameter populated with SQL metacharacters or XML path expressions like extractvalue.
]]>highthreatsql-injectionvulnerabilitywebserver