Loading story…
A critical SQL injection vulnerability was discovered in the Orkes Conductor platform (version 5.2.4, platform v1.19.12), allowing authenticated attackers to exploit the sort parameter in the /api/workflow/search endpoint. By injecting crafted SQL expressions, attackers can perform time-based blind SQL injection attacks against the backend PostgreSQL database, bypassing basic input filtering. Proof-of-concept payloads demonstrated the ability to induce measurable delays in server response, confirming the vulnerability and enabling potential data exfiltration through timing-based inference.
In addition to this real-world vulnerability, practical labs demonstrate exploitation techniques for blind SQL injection, including out-of-band data exfiltration and conditional error-based methods. These labs guide users through leveraging tracking cookies to inject payloads, using tools like Burp Suite and custom Python scripts to extract sensitive information such as administrator passwords from vulnerable databases. The combination of real-world disclosure and hands-on labs highlights the ongoing risk posed by blind SQL injection flaws and the importance of robust input validation and monitoring in web applications.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A second lab write-up demonstrated exploiting a tracking-cookie blind SQL injection flaw to trigger out-of-band DNS or HTTP interactions to an external server. The method enabled asynchronous exfiltration of the administrator password from the database without changing the application's normal response.
LevelBlue SpiderLabs published a report disclosing an SQL injection vulnerability in Orkes Conductor and assigned it CVE-2025-66387. The reference indicates public technical disclosure of the issue, but provides no additional remediation or exploitation details in the supplied content.
A PortSwigger-style lab write-up showed how a tracking cookie used for analytics could be exploited for blind SQL injection by triggering database errors conditionally. The technique was used to infer and extract the administrator password from a users table despite no direct query output being returned.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcelevelblue.com
Open sourceosintteam.blog
Open sourceblog.silentsignal.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have detailed real-world exploitation techniques used to identify and leverage vulnerabilities in web applications, focusing on bug bounty scenarios. One researcher described successfully exploiting a path traversal vulnerability in a company's file upload functionality, allowing arbitrary file overwrites and folder creation by manipulating file save locations. Additional attempts were made to exploit content-type handling and CSV injection, though system command execution was not achieved in that case. Another researcher demonstrated the use of UNION-based SQL injection to enumerate database tables, extract credential columns, and ultimately dump usernames and passwords from a non-Oracle database. By exploiting a vulnerable product category filter, the attacker was able to gain administrator access, highlighting the risk of improperly sanitized user input in web applications. Both cases underscore the importance of secure coding practices and thorough application testing to prevent such vulnerabilities from being exploited in the wild.
Jun 29, 2026
Attackers have demonstrated the exploitation of SQL injection vulnerabilities in web applications through the use of UNION-based attacks, specifically targeting product category filters. In both documented cases, the web applications failed to properly sanitize or validate user-supplied input, allowing malicious actors to inject arbitrary SQL code into backend queries. The first scenario details how attackers can use a UNION attack to identify which columns in a database query are compatible with text data, a crucial step in crafting effective payloads for data extraction. By systematically testing columns, attackers can determine which ones will accept string values, enabling them to retrieve sensitive information from the database. The second scenario focuses on PostgreSQL 12.22 and illustrates how a UNION-based SQL injection can be used to retrieve multiple values from a single column. This technique allows attackers to concatenate or enumerate data, increasing the efficiency and impact of the attack. Both references emphasize the serious risk posed by such vulnerabilities, as they can lead to unauthorized access to sensitive data, compromise of user privacy, and potential full database compromise. The proof-of-concept steps provided in each case show how easily these attacks can be reproduced in vulnerable environments, underscoring the importance of robust input validation and query parameterization. The impact of these vulnerabilities is significant, as attackers can bypass authentication, escalate privileges, or exfiltrate confidential information. The educational materials stress that these techniques are intended for ethical use only, warning that unauthorized exploitation is illegal and unethical. The documentation also highlights the need for organizations to regularly test their web applications for SQL injection flaws, particularly in areas where user input is incorporated into database queries. Security teams are advised to implement strict input validation, use prepared statements, and conduct regular code reviews to mitigate the risk. The examples provided demonstrate that even seemingly innocuous features like product category filters can be vectors for serious attacks if not properly secured. The references also note that attackers often target such features because they are commonly overlooked during security assessments. Both sources provide detailed technical guidance on identifying and exploiting these vulnerabilities, making them valuable resources for defenders seeking to understand and remediate SQL injection risks. The overall message is clear: SQL injection remains a prevalent and dangerous threat, and organizations must remain vigilant in securing all user input points. Failure to address these vulnerabilities can result in severe consequences, including data breaches, regulatory penalties, and reputational damage. The documentation serves as a reminder that proactive security measures are essential to protect against evolving attack techniques.
Jun 29, 2026
A high-severity blind SQL injection vulnerability tracked as **`CVE-2026-71287`** was disclosed in **Cacti**, where insufficient sanitization in the `sanitize_sql_column()` function allows attacker-controlled input to reach raw `ORDER BY` clauses. The flaw affects multiple pages, including `user_log.php`, `utilities.php`, `user_domains.php`, and `user_group_admin.php`, through the `sort_column` GET parameter. Because the regex-based allowlist still permits characters needed for SQL time-delay functions, an authenticated user can trigger time-based blind SQL injection against the Cacti database. The issue was assigned a **CVSS 3.1 score of 8.8** and mapped to **`CWE-89`**, with exploitation possible by any authenticated Cacti account regardless of privilege level. Activity in the upstream **Cacti** GitHub repository shows broader security remediation work around SQL injection and `ORDER BY` parameter sanitization, alongside other hardening changes, indicating the project is actively addressing input-validation weaknesses and related web application security risks in the codebase.
Aug 6, 2026