{"id":"CVE-2026-63167","kind":"vulnerability","aliases":["CVE-2026-63167"],"related":[],"title":"Omnispace Agora Project: SQL injection through personsSort session value","description":"Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.","summary":"Omnispace Agora Project through 26.10.0 concatenates the personsSort session value unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. An authenticated general administrator can inject arbitrary SQL and leak database information, such as the MariaDB version, through the user and space listing pages.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agora-project","fixed":[],"affected":"<= 26.10.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","omnispace-agora","other","php","self-hosted","sql-injection"],"not_affected_if":["auth-required","no-admin-accounts-exposed"],"how_to_check":"Check the installed Agora Project version (admin panel/footer). Versions up to and including 26.10.0 are listed as affected. Look in app/ModUser/MdlUser.php and app/ModSpace/MdlSpace.php for personsSort concatenated into ORDER BY. Fixed version unknown: the upstream release notes (latest 26.10.5) do not mention it.","fix":null,"status":"open","published_at":"2026-11-13T17:17:34+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:48:43+00:00","updated_at":"2026-11-13T17:50:15+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-13T17:48:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Omnispace Agora Project: SQL injection through personsSort session value","impact":"high","summary":"Omnispace Agora Project through 26.10.0 concatenates the personsSort session value unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. An authenticated general administrator can inject arbitrary SQL and leak database information, such as the MariaDB version, through the user and space listing pages.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace-agora","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"database contents readable and arbitrary SQL run by an admin","analyst_note":"Find the vendor advisory or a fixed Omnispace Agora Project version; the NVD entry gives none here.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-accounts-exposed"],"who_is_affected":"Teams that run Omnispace Agora Project through version 26.10.0 are exposed, and the attacker must already hold a general administrator account. The sources name the user and space listing pages as the injection path. Installations without general administrator accounts in use are less exposed, but the sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4607,"output_tokens":495,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or a fixed Omnispace Agora Project version; the NVD entry gives none here.","search":"'-2026':11A,14A '-63167':12A,15A '26.10.0':37B,80C 'administr':55B,90C 'agora':2A,17A,24B,34B,77C 'agora-project':16A 'allow':87C 'arbitrari':58B,93C 'attack':113C 'auth':20B 'auth-requir':19B 'authent':53B,88C 'base':119C 'claus':47B,108C 'concaten':38B,103C 'contain':81C 'cve':10A,13A 'databas':62B,126C 'error':118C 'error-bas':117C 'extractvalu':120C 'general':54B,89C 'host':29B 'inform':63B,127C 'inject':5A,32B,57B,84C,92C 'leak':61B,125C 'list':74B,138C 'mariadb':67B,131C 'mdlspace.php':51B,112C 'mdluser.php':49B,110C 'omnispac':1A,23B,33B,76C 'omnispace-agora':22B 'order':45B,106C 'page':75B,139C 'payload':121C 'personssort':7A,40B,98C,123C 'php':26B 'project':3A,18A,35B,78C 'requir':21B 'self':28B 'self-host':27B 'session':8A,41B,99C 'set':96C 'space':73B,137C 'sql':4A,31B,59B,83C,94C 'sql-inject':30B 'submit':115C 'unsanit':43B,104C 'user':71B,135C 'valu':9A,42B,100C 'version':68B,132C 'via':133C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Omnispace Agora Project through version 26.10.0 are exposed, and the attacker must already hold a general administrator account. The sources name the user and space listing pages as the injection path. Installations without general administrator accounts in use are less exposed, but the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["agoraproject"],"ptokens":["agora","project"],"labels":["authrequired","high","omnispaceagora","other","php","selfhosted","sqlinjection"],"campaign_type":null,"search_a":"'-2026':11A,14A '-63167':12A,15A 'agora':2A,17A 'agora-project':16A 'cve':10A,13A 'inject':5A 'omnispac':1A 'personssort':7A 'project':3A,18A 'session':8A 'sql':4A 'valu':9A","search_b":"'26.10.0':37B 'administr':55B 'agora':24B,34B 'arbitrari':58B 'auth':20B 'auth-requir':19B 'authent':53B 'claus':47B 'concaten':38B 'databas':62B 'general':54B 'host':29B 'inform':63B 'inject':32B,57B 'leak':61B 'list':74B 'mariadb':67B 'mdlspace.php':51B 'mdluser.php':49B 'omnispac':23B,33B 'omnispace-agora':22B 'order':45B 'page':75B 'personssort':40B 'php':26B 'project':35B 'requir':21B 'self':28B 'self-host':27B 'session':41B 'space':73B 'sql':31B,59B 'sql-inject':30B 'unsanit':43B 'user':71B 'valu':42B 'version':68B","search_c":"'26.10.0':80C 'administr':90C 'agora':77C 'allow':87C 'arbitrari':93C 'attack':113C 'authent':88C 'base':119C 'claus':108C 'concaten':103C 'contain':81C 'databas':126C 'error':118C 'error-bas':117C 'extractvalu':120C 'general':89C 'inform':127C 'inject':84C,92C 'leak':125C 'list':138C 'mariadb':131C 'mdlspace.php':112C 'mdluser.php':110C 'omnispac':76C 'order':106C 'page':139C 'payload':121C 'personssort':98C,123C 'project':78C 'session':99C 'set':96C 'space':137C 'sql':83C,94C 'submit':115C 'unsanit':104C 'user':135C 'valu':100C 'version':132C 'via':133C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63167","severity":null,"published_at":"2026-11-13T17:17:34+00:00","modified_at":"2026-11-13T17:17:34+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63167:3911","url":"https://github.com/xech/agora-project/releases","severity":null,"published_at":"2026-11-13T17:50:15+00:00","modified_at":"2026-11-13T17:50:15+00:00","first_seen_at":"2026-11-13T17:50:15+00:00","fetched_at":"2026-11-13T17:50:15+00:00","note":"No vendor advisory or fix found. NVD says through 26.10.0 (siblings from the same akailabs batch, e.g. CVE-2026-63165, say before 26.10.0), so 26.10.0 may or may not be affected. The release notes for 26.10.5 do not mention SQL fixes. No exploitation or PoC found. Nothing verified.","cites":["https://github.com/xech/agora-project/releases"]}],"documents":[{"id":148153,"url":"https://github.com/xech/agora-project/releases","title":"xech/agora-project releases (latest 26.10.5)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}