CVE-2026-111619 Details

A SQL injection vulnerability has been identified in FilePress versions through 3.0.1. This vulnerability allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated 'asc' parameter. The injection occurs in the 'dzz/pichome/library/filelist.php' and 'dzz/collection/filelist.php' files. Exploitation of this vulnerability enables attackers to use blind boolean or time-based subqueries to extract database rows, including administrator credential hashes.

To address this vulnerability, it is recommended to validate and sanitize the 'asc' parameter before it is used in the ORDER BY clause. Implementing a whitelist of acceptable values and ensuring that user input is properly escaped can help prevent SQL injection attacks. Additionally, conducting a thorough security review of the application's SQL query handling can identify and mitigate similar vulnerabilities.