CVE-2026-96604 Details
Description
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A SQL injection vulnerability has been identified in SoftNews Media Group DataLife Engine version 18.0. The issue resides in the search module, specifically within the 'engine/modules/search.php' file. The vulnerability is triggered by manipulating the 'story' parameter, which is processed by the 'strip_data' function before being sent to a MySQL query. This exploitation allows attackers to inject arbitrary boolean conditions into the SQL query, facilitating unauthorized access to the database. The vulnerability can be exploited remotely without authentication.
The vulnerability can be remediated by applying proper SQL escaping to the 'story' parameter using the 'safesql' function before it is used in a SQL query. Additionally, migrating the search functionality to use parameterized or prepared statements would eliminate the reliance on string sanitization for SQL context.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://pastebin.com/nkMeTizS | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-96604 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/899134 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408972 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408972/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SoftNews Media Group DataLife Engine | 18.0 (build 103) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |