https://vulnerability.circl.lu/sightings/feed 2026-09-10T18:58:47.963620+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ef3fc84d-c225-48f1-a6f3-556053277246/export 2026-09-10T18:58:47.985879+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ef3fc84d-c225-48f1-a6f3-556053277246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4v6nxm3l2k", "content": "CVE-2026-79322 (HIGH) CVSS 8.6: https://experiencedigest.org/2026/09/09/212042.html", "creation_timestamp": "2026-09-10T01:21:24.912902Z"} 2026-09-10T01:21:24.912902+00:00 https://vulnerability.circl.lu/sighting/3c6d1b8e-d575-43d1-a767-1c1ba50b7944/export 2026-09-10T18:58:47.988832+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3c6d1b8e-d575-43d1-a767-1c1ba50b7944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d7ln6a7y6dk2m", "content": "CVE-2026-79322 - Mageplaza Blog for Magento SQL Injection\nCVE ID : CVE-2026-79322\n \n Published : Sept. 9, 2026, 7:17 p.m. | 18\u00a0minutes ago\n \n Description : SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4....", "creation_timestamp": "2026-09-09T19:58:51.028593Z"} 2026-09-09T19:58:51.028593+00:00 https://vulnerability.circl.lu/sighting/35c4448a-74a1-42ea-b077-f0d08a9b47ef/export 2026-09-10T18:58:47.989167+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "35c4448a-74a1-42ea-b077-f0d08a9b47ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://gist.github.com/mrtantoine/417ee9b774f022bd747211b9eadc0069", "content": "# CVE-2026-79322 \u2014 SQL Injection in Mageplaza Blog for Magento 2 through 4.3.2\n\n## Summary\n\nSQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.\n\n## Affected\n\n- Product: Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension)\n- Versions: through 4.3.2 (current latest release, published 2026-07-02; no fixed version available)\n- Authentication required: none (unauthenticated)\n\n## Details\n\nBlock/Post/RelatedProduct.php line 150 reads the id query parameter ($postId = $this->getRequest()->getParam('id')) and line 160 concatenates it directly into a Zend_Db_Select where() clause: ->where('product_post.post_id = ' . $postId), without cast, quoting or binding. Vulnerable code at commit d3b0cdfbe6635bd0a15cb2acde165d00660ccb0b (tag v4.3.2).\n\nVerified on a local Mage-OS lab running Mageplaza Blog 4.3.2 (latest). Server-side confirmation from MySQL general query log shows the injected payload reaches the database verbatim:\n\nWHERE (product_post.post_id = 1 AND SLEEP(5))\n\nIn the same request, the post-load query correctly binds the same input (WHERE 'mageplaza_blog_post'.'post_id'='1 AND SLEEP(5)'), which shows the RelatedProduct block is an oversight rather than intentional behaviour.\n\nTime-based proof, warm URLs, 3 passes:\n- pass1: SLEEP(0)=0.29s, SLEEP(5)=5.31s\n- pass2: SLEEP(0)=0.28s, SLEEP(5)=5.33s\n- pass3: SLEEP(0)=0.33s, SLEEP(5)=5.24s\n\nPrecondition: the target post must have at least one related product configured.\n\n## Attack vector\n\nUnauthenticated HTTP GET. An attacker appends SQL to the id parameter of /mpblog/post/view (e.g. id=1 AND SLEEP(5)); the value is concatenated raw into the related-products WHERE clause and executed by the database. No user interaction required.\n\n## Impact\n\nAn unauthenticated remote attacker can execute arbitrary SQL queries, read the full database contents (customer data, admin credentials, orders), and cause denial of service.\n\n## CVSS 3.1\n\nAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L = 8.6 (High)\n\n## Remediation\n\nUse parameter binding instead of string concatenation in _getProductCollection(): replace ->where('product_post.post_id = ' . $postId) with ->where('product_post.post_id = ?', (int) $postId).\n\n## References\n\n- https://github.com/mageplaza/magento-2-blog/tree/v4.3.2\n- https://www.mageplaza.com/magento-2-blog-extension/\n- CWE-89 SQL Injection\n\n## Credit\n\nDiscovered by Antoine Morato.", "creation_timestamp": "2026-09-08T21:28:13.902473Z"} 2026-09-08T21:28:13.902473+00:00