---
id: "CVE-2022-51023"
kind: "vulnerability"
aliases: ["CVE-2022-51023"]
title: "PHPOK: unauthenticated SQL injection in sort parameter leaks database data"
severity: "high"
cvss: 8.8
epss: 0.00262
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpok", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-22T11:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-51023", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-51023", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# PHPOK: unauthenticated SQL injection in sort parameter leaks database data

PHPOK versions 4.5.000 through 5.4.080 let anonymous visitors inject SQL through the sort parameter of /api.php?c=project&f=index. An attacker can pull database contents out through error messages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the PHPOK version in the admin panel or install files; versions from 4.5.000 up to but not including 5.4.081 are affected.
Send a GET to /api.php?c=project&f=index with a sort value containing extractvalue( and look for database error output.

## Fix

Upgrade PHPOK to 5.4.081 or later.
If upgrading is not possible, block requests with sort parameters containing SQL syntax at the web server or WAF.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-51023
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-51023

## From the sources

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_