CVE-2026-51946 Details
Description
SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints
A SQL injection vulnerability has been identified in GoAdmin, specifically in version 1.2.26. This vulnerability allows remote attackers to execute arbitrary SQL code and extract sensitive information. The issue arises from unsanitized user input in the '__sort_type' URL parameter, which is processed by the 'getDataFromDatabase' function in the 'default.go' file. The vulnerability is present on all '/admin/info/{table}' endpoints.
To address this vulnerability, GoAdmin applications should implement proper input validation for the '__sort_type' parameter. This can be done by adding a validation function that checks user-supplied values against an allowlist of accepted options, such as 'ASC' and 'DESC'. The validation should be applied before the parameters are used in SQL query construction, ensuring that only sanitized and verified input is processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.silentgrid.com/ai-assisted-penetration-testing-in-practice/ | [email protected] | ExploitRemedyTechnical Analysis |
| https://github.com/GoAdminGroup/go-admin/tree/main | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| GoAdminGroup GoAdmin | <= v1.2.26 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |