CVE-2026-28226 PUBLISHED

Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing

Assigner: GitHub_M
Reserved: 25.02.2026 Published: 26.02.2026 Updated: 26.02.2026

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through RemapOrderBy(), an authenticated attacker can inject SQL expressions into the ORDER BY clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor phishingclub
Product phishingclub
Versions
  • Version < 1.30.2 is affected

References

Problem Types

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE