Executive brief
Garlic-Hub is a digital signage management application. A SQL injection vulnerability in the Items module allows unauthenticated attackers to execute arbitrary database queries, potentially exposing or modifying sensitive data stored in the system's database.
Technical details
A SQL injection vulnerability (CWE-89) exists in src/Modules/Items/Repositories/ItemsRepository.php due to unsafe string concatenation of user input (the $owner variable) into a SQL query. The vulnerable code directly concatenates the $owner parameter into the query builder without parameterized statements or sanitization. An attacker can exploit this via time-based blind SQL injection attacks, as demonstrated by forcing a 5-second server delay, which confirms ability to execute arbitrary SQL. The vulnerability allows full database read/write access depending on the application's database privileges.
Affected products
- Garlic-Hub Garlic-Hub v1.0.1
Timeline
- 2026-03-23: disclosed: Vulnerability discovered and reported by Gaurish Bahurupi
- 2026-09-10: advisory: CVE-2026-38626 published