{"id":"CVE-2026-124625","kind":"vulnerability","aliases":["CVE-2026-124625"],"related":[],"title":"PipraPay: admin panel SQL injection in deleteData lets attackers read or change data","description":"A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"PipraPay 3.0.0's admin panel passes the selected_ids/ItemID parameter into a SQL query in the deleteData function without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit has been disclosed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PipraPay","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","piprapay","self-hosted"],"not_affected_if":["admin-panel-not-exposed"],"how_to_check":"- Check whether PipraPay is installed and which version is running: `pp-content/pp-include/pp-functions.php` in the install directory\n- Look for `deleteData` in `pp-content/pp-include/pp-functions.php` and check whether selected_ids or ItemID is used directly in a SQL statement","fix":null,"status":"open","published_at":"2026-11-09T14:17:16+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","triaged_at":"2026-11-09T14:27:40+00:00","updated_at":"2026-11-09T14:27:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T14:27:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PipraPay: admin panel SQL injection in deleteData lets attackers read or change data","impact":"medium","summary":"PipraPay 3.0.0's admin panel passes the selected_ids/ItemID parameter into a SQL query in the deleteData function without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit has been disclosed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["piprapay","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or alters database contents remotely","analyst_note":"Confirm whether the admin panel requires authentication and whether a fixed version exists; the project has not responded, so check the NVD entry and the public issue report for updates.","how_to_check":"- Check whether PipraPay is installed and which version is running: `pp-content/pp-include/pp-functions.php` in the install directory\n- Look for `deleteData` in `pp-content/pp-include/pp-functions.php` and check whether selected_ids or ItemID is used directly in a SQL statement","plain_action":"","product_name":"PipraPay","needs_analyst":true,"not_affected_if":["admin-panel-not-exposed"],"who_is_affected":"PipraPay 3.0.0 installations with the admin panel reachable over the network are exposed, since the flaw is in the admin-side delete handler that builds SQL from the selected_ids/ItemID parameter. Teams that do not run PipraPay, or that restrict the admin panel to trusted networks, face less exposure but should still confirm the reach of their admin endpoints. The sources do not say whether an authenticated admin session is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00079,"input_tokens":4590,"output_tokens":661,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124625':16A,19A '-2026':15A,18A '/pp-include/pp-functions.php':92C '3.0.0':28B,77C 'admin':2A,30B,96C 'affect':78C 'alter':57B 'applic':59B 'argument':102C 'attack':9A,50B,115C 'chang':12A 'compon':95C 'content':91C 'cve':14A,17A 'data':13A 'databas':61B 'deletedata':7A,43B,85C 'detect':74C 'disclos':68B,121C 'earli':134C 'exploit':65B,118C 'file':88C 'function':44B,84C 'host':26B 'ids/itemid':35B,104C 'inform':130C 'initi':113C 'inject':5A,52B,108C 'issu':81C,137C 'lead':105C 'let':8A 'manipul':99C 'may':124C 'panel':3A,31B,97C 'paramet':36B 'pass':32B 'php':22B 'piprapay':1A,20A,23B,27B,76C 'possibl':111C 'pp':90C 'pp-content':89C 'problem':133C 'project':128C 'proper':46B 'public':64B,122C 'queri':40B 'read':10A,55B 'remot':49B,116C 'report':138C 'respond':142C 'sanit':47B 'secur':70C 'select':34B,103C 'self':25B 'self-host':24B 'sql':4A,39B,53B,107C 'use':126C 'vulner':71C 'without':45B 'yet':143C","nicknames":[],"mitigations":[],"who_affected":"PipraPay 3.0.0 installations with the admin panel reachable over the network are exposed, since the flaw is in the admin-side delete handler that builds SQL from the selected_ids/ItemID parameter. Teams that do not run PipraPay, or that restrict the admin panel to trusted networks, face less exposure but should still confirm the reach of their admin endpoints. The sources do not say whether an authenticated admin session is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["piprapay"],"ptokens":["piprapay"],"labels":["medium","other","php","piprapay","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124625':16A,19A '-2026':15A,18A 'admin':2A 'attack':9A 'chang':12A 'cve':14A,17A 'data':13A 'deletedata':7A 'inject':5A 'let':8A 'panel':3A 'piprapay':1A,20A 'read':10A 'sql':4A","search_b":"'3.0.0':28B 'admin':30B 'alter':57B 'applic':59B 'attack':50B 'databas':61B 'deletedata':43B 'disclos':68B 'exploit':65B 'function':44B 'host':26B 'ids/itemid':35B 'inject':52B 'panel':31B 'paramet':36B 'pass':32B 'php':22B 'piprapay':23B,27B 'proper':46B 'public':64B 'queri':40B 'read':55B 'remot':49B 'sanit':47B 'select':34B 'self':25B 'self-host':24B 'sql':39B,53B 'without':45B","search_c":"'/pp-include/pp-functions.php':92C '3.0.0':77C 'admin':96C 'affect':78C 'argument':102C 'attack':115C 'compon':95C 'content':91C 'deletedata':85C 'detect':74C 'disclos':121C 'earli':134C 'exploit':118C 'file':88C 'function':84C 'ids/itemid':104C 'inform':130C 'initi':113C 'inject':108C 'issu':81C,137C 'lead':105C 'manipul':99C 'may':124C 'panel':97C 'piprapay':76C 'possibl':111C 'pp':90C 'pp-content':89C 'problem':133C 'project':128C 'public':122C 'remot':116C 'report':138C 'respond':142C 'secur':70C 'select':103C 'sql':107C 'use':126C 'vulner':71C 'yet':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124625","severity":null,"published_at":"2026-11-09T14:17:16+00:00","modified_at":"2026-11-09T14:17:16+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","fetched_at":"2026-11-09T14:26:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}