CVE-2026-37505 Details
Description
SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.
A SQL injection vulnerability has been identified in V2Board versions through 1.7.4. The issue arises in the UserController, where the 'sort' parameter from user input is directly passed to the 'orderBy' method without any validation. This flaw allows an authenticated admin to sort users by any database column, including sensitive fields such as passwords and tokens, potentially leading to unauthorized information disclosure.
To address this vulnerability, it's recommended to validate the 'sort' parameter against a predefined allowlist of acceptable column names before applying it to the database query. Additionally, the sorting direction should be checked to ensure only 'ASC' or 'DESC' values are used.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 | [email protected] | Third Party Advisory |
| https://github.com/v2board/v2board | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| v2board v2board | <= 1.7.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | New CVE Received | [email protected] |