{"id":"CVE-2026-111619","kind":"vulnerability","aliases":["CVE-2026-111619"],"related":[],"title":"FilePress: SQL injection via asc parameter leaks admin credential hashes","description":"FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.","summary":"FilePress <= 3.0.1 concatenates the unvalidated asc GET parameter into ORDER BY in two file-list handlers; any logged-in library member can run blind boolean/time-based SQL to read other users' and admin credential hashes. No fixed release exists; no known exploitation or public PoC.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FilePress","fixed":[],"affected":"<= 3.0.1","ecosystem":"php"}],"ecosystems":[],"tags":["authenticated","dzzoffice","filepress","package","php","pichome","self-hosted","sql-injection"],"not_affected_if":["auth-required","no-self-registration","no-user-accounts","not-deployed"],"how_to_check":"1) Check FilePress version (<= 3.0.1 affected; no fixed version exists). 2) In dzz/pichome/library/filelist.php (~line 93) and dzz/collection/filelist.php (~line 56), see if $asc is only trim()'d and not restricted to asc/desc. 3) Grep web logs for mod=pichome&op=library&do=filelist or collection filelist requests with asc values containing select, case, if, sleep, benchmark, ascii, mid. 4) Check whether open registration is on: any registered library member can reach it.","fix":"No patched version published as of 2026-10-25; latest release 3.0.1 is affected. Interim: patch both files so asc is whitelisted to 'asc'/'desc' (e.g. in dzz/pichome/library/filelist.php and dzz/collection/filelist.php); upgrade once the vendor ships a release.","status":"open","published_at":"2026-10-16T18:17:41+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:38+00:00","updated_at":"2026-10-25T03:46:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:36:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FilePress: SQL injection via asc parameter leaks admin credential hashes","impact":"high","summary":"FilePress through 3.0.1 does not validate the asc parameter, which is placed into ORDER BY clauses in dzz/pichome/library/filelist.php and dzz/collection/filelist.php. An authenticated low-privilege user can use blind boolean or time-based SQL subqueries to extract database rows, including administrator password hashes.","category":"package","nicknames":[],"who_cares":["self-hosted","filepress","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads database rows, including administrator password hashes.","analyst_note":"Find the vendor fix or patched version and confirm whether the asc parameter fix is in a release; check NVD for the CVSS vector and whether the default config exposes the affected endpoints.","how_to_check":"- Check the installed FilePress version; versions through `3.0.1` are affected per the advisory\n- Look for `dzz/pichome/library/filelist.php` and `dzz/collection/filelist.php` and check whether the `asc` parameter is passed into the ORDER BY clause without validation\n- Review web server access logs for requests to these two files with unusual `asc` values containing SQL keywords or subqueries","needs_analyst":true,"not_affected_if":["no-user-accounts","not-deployed"],"who_is_affected":"Sites running FilePress 3.0.1 or earlier are exposed, and the attacker needs a valid low-privilege user account on the instance. Installations where nobody can register or log in, or where the app is not deployed, can skip it. The sources do not say whether a fixed version exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3348,"output_tokens":628,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor fix or patched version and confirm whether the asc parameter fix is in a release; check NVD for the CVSS vector and whether the default config exposes the affected endpoints.","search":"'-111619':13A,16A '-2026':12A,15A '3.0.1':31B,78C 'admin':8A,63B 'administr':122C 'allow':85C 'asc':5A,35B,101C 'attack':103C 'authent':18B,86C 'base':111C 'blind':55B,106C 'boolean':107C 'boolean/time-based':56B 'claus':97C 'concaten':32B 'contain':79C 'credenti':9A,64B,123C 'cve':11A,14A 'databas':119C 'dzz/collection/filelist.php':116C 'dzz/pichome/library/filelist.php':114C 'dzzoffic':19B 'exist':69B 'exploit':72B 'extract':118C 'file':44B 'file-list':43B 'filepress':1A,17A,20B,30B,76C 'fix':67B 'get':36B 'handler':46B 'hash':10A,65B,124C 'host':26B 'includ':121C 'inject':3A,29B,82C,92C 'known':71B 'leak':7A 'librari':51B 'list':45B 'log':49B 'logged-in':48B 'low':88C 'low-privileg':87C 'member':52B 'order':39B,95C 'packag':21B 'paramet':6A,37B,102C 'php':22B 'pichom':23B 'poc':75B 'privileg':89C 'public':74B 'read':59B 'releas':68B 'row':120C 'run':54B 'self':25B 'self-host':24B 'sql':2A,28B,57B,81C,93C 'sql-inject':27B 'subqueri':112C 'time':110C 'time-bas':109C 'two':42B 'unvalid':34B,100C 'use':105C 'user':61B,90C 'via':4A,98C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running FilePress 3.0.1 or earlier are exposed, and the attacker needs a valid low-privilege user account on the instance. Installations where nobody can register or log in, or where the app is not deployed, can skip it. The sources do not say whether a fixed version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111619","severity":null,"published_at":"2026-10-16T18:17:41+00:00","modified_at":"2026-10-21T21:17:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111619:789","url":null,"severity":null,"published_at":"2026-10-25T03:46:52+00:00","modified_at":"2026-10-25T03:46:52+00:00","first_seen_at":"2026-10-25T03:46:52+00:00","fetched_at":"2026-10-25T03:46:52+00:00","note":"No fixed release found: 3.0.1 (Jul) is latest on GitHub releases; CVE/VulnCheck say affected 0 through 3.0.1; reporter write-up is static review only, no PoC, not exploited. CVSS 4.0 7.1 / 3.1 6.5 (AV:N/PR:L). Related: unpatched pre-auth SQLi issue #70 (order param, shares) and CVE-2026-90879 in same product. Nothing marked verified (no vendor words)."}],"documents":[{"id":3338,"url":"https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqli","title":"FilePress authenticated ORDER BY SQL injection (reporter write-up)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3339,"url":"https://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php","title":"VulnCheck: FilePress through 3.0.1 SQLi via asc","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3340,"url":"https://github.com/zyx0814/FilePress/releases","title":"FilePress releases (latest 3.0.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}