{"vulnerability": "CVE-2021-26599", "sightings": [{"uuid": "45733829-75f9-41c9-a86c-982d5bc00242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26599", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lqspc4bpzm24", "content": "", "creation_timestamp": "2025-06-04T21:02:23.023675Z"}, {"uuid": "3d661819-6dd6-4906-b5e3-d1cb10137105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26599", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-26599.yaml", "content": "", "creation_timestamp": "2025-06-03T13:00:35.000000Z"}, {"uuid": "e4dce6b9-fd7b-4ba9-956e-c051db03b59d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26599", "type": "seen", "source": "https://t.me/cibsecurity/39622", "content": "\u203c CVE-2021-26599 \u203c\n\nImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-28T07:39:49.000000Z"}, {"uuid": "6e80bfa3-4d27-4fe9-ad3c-7415e1207b69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26599", "type": "seen", "source": "https://t.me/hacking_Attack/47296", "content": "Exploit Collector\nImpressCMS 1.4.2 SQL Injection\n\nhttps://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png \nImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.\n\nMD5 | 87f67399dc57cf0886d71c379f9cc8b8\n\nDownload\n---------------------------------------------------------------\nImpressCMS <=\n---------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.3 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /include/findusers.php script:\n\n281.            $total = \n$user_handler->getUserCountByGroupLink(@$_POST[\"groups\"], $criteria);\n282.\n283.            $validsort = array(\"uname\", \"email\", \"last_login\", \n\"user_regdate\", \"posts\");\n284.            $sort = (!in_array($_POST['user_sort'], $validsort)) ? \n\"uname\" : $_POST['user_sort'];\n285.            $order = \"ASC\";\n286.            if (isset($_POST['user_order']) && $_POST['user_order'] \n== \"DESC\") {\n287.                $order = \"DESC\";\n288.            }\n289.\n290.            $criteria->setSort($sort);\n291.            $criteria->setOrder($order);\n292.            $criteria->setLimit($limit);\n293.            $criteria->setStart($start);\n294.            $foundusers = \n$user_handler->getUsersByGroupLink(@$_POST[\"groups\"], $criteria, TRUE);\n\nUser input passed through the \"groups\" POST parameter is not properly \nsanitized before being passed to the \nicms_member_Handler::getUserCountByGroupLink() and \nicms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294. \nThese methods use the first argument to construct a SQL query without \nproper validation, and this can be exploited by remote attackers to e.g. \nread sensitive data from the \"users\" database table through \nboolean-based SQL Injection attacks. The application allows for stacked \nSQL queries, as such this vulnerability could be exploited to e.g. \ncreate a new admin user and execute arbitrary PHP code.\n[-] Solution:\n\nUpgrade to version 1.4.4 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[29/01/2021] - Vulnerability acknowledged by the vendor\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed\n[11/02/2022] - Vendor was informed about the ineffective fix\n[09/03/2022] - Version 1.4.4 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26599 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081145\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-04\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:49.780828Z"}, {"uuid": "ae3905f6-e79a-44f3-b78b-a03173d71e10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26599", "type": "seen", "source": "https://t.me/hacking_Attack/47296", "content": "Exploit Collector\nImpressCMS 1.4.2 SQL Injection\n\nhttps://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png \nImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.\n\nMD5 | 87f67399dc57cf0886d71c379f9cc8b8\n\nDownload\n---------------------------------------------------------------\nImpressCMS <=\n---------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.3 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /include/findusers.php script:\n\n281.            $total = \n$user_handler->getUserCountByGroupLink(@$_POST[\"groups\"], $criteria);\n282.\n283.            $validsort = array(\"uname\", \"email\", \"last_login\", \n\"user_regdate\", \"posts\");\n284.            $sort = (!in_array($_POST['user_sort'], $validsort)) ? \n\"uname\" : $_POST['user_sort'];\n285.            $order = \"ASC\";\n286.            if (isset($_POST['user_order']) && $_POST['user_order'] \n== \"DESC\") {\n287.                $order = \"DESC\";\n288.            }\n289.\n290.            $criteria->setSort($sort);\n291.            $criteria->setOrder($order);\n292.            $criteria->setLimit($limit);\n293.            $criteria->setStart($start);\n294.            $foundusers = \n$user_handler->getUsersByGroupLink(@$_POST[\"groups\"], $criteria, TRUE);\n\nUser input passed through the \"groups\" POST parameter is not properly \nsanitized before being passed to the \nicms_member_Handler::getUserCountByGroupLink() and \nicms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294. \nThese methods use the first argument to construct a SQL query without \nproper validation, and this can be exploited by remote attackers to e.g. \nread sensitive data from the \"users\" database table through \nboolean-based SQL Injection attacks. The application allows for stacked \nSQL queries, as such this vulnerability could be exploited to e.g. \ncreate a new admin user and execute arbitrary PHP code.\n[-] Solution:\n\nUpgrade to version 1.4.4 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[29/01/2021] - Vulnerability acknowledged by the vendor\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed\n[11/02/2022] - Vendor was informed about the ineffective fix\n[09/03/2022] - Version 1.4.4 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26599 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081145\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-04\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:03.203317Z"}]}