Executive brief
SourceBans Material Admin is a web-based management interface for game server administrators to manage player bans and permissions. A security flaw allows an attacker to modify administrative account data, including passwords and access levels. This could lead to a complete takeover of the management system, allowing unauthorized users to grant themselves full control over game servers and player data.
Technical details
A SQL injection vulnerability exists in the 'ChangeAdminsInfos' xajax handler within 'includes/sb-callback.php'. The application uses a custom 'RemoveCode' function that relies on 'htmlspecialchars' without the 'ENT_QUOTES' flag; on PHP versions 8.0 and below, this fails to escape single quotes, allowing an attacker to break out of the SQL UPDATE statement. By crafting the 'vk' or 'skype' parameters, an attacker can modify arbitrary columns in the 'sb_admins' table, such as 'password' or 'extraflags'. Furthermore, the endpoint lacks CSRF protection and incorrectly processes GET requests as POST, enabling a 'one-click' account takeover if a logged-in administrator visits a malicious link. The issue is fixed in version 1.1.6 (commit a871904).
Affected products
- SourceBans Material Admin (Web) before 1.1.6 (commit 3ecd95e / a871904)
Timeline
- 2025-10-29: other: Vulnerability discovered by researcher
- 2025-11-12: disclosed: Issue reported to vendor via GitHub
- 2026-05-28: advisory: CVE-2026-30760 published