Executive brief
MixPHP, a high-performance PHP framework, contains a security flaw in how it handles database queries. An attacker can send specially crafted data to an application built with this framework to manipulate database commands. This could allow unauthorized access to sensitive information, data modification, or complete compromise of the application's database.
Technical details
A SQL injection vulnerability exists in MixPHP Framework versions 2.x through 2.2.17. The root cause is located in the `joinOn` function within `BuildHelper.php`, where table and column names provided in the `on` array are concatenated directly into JOIN clauses without proper validation or escaping. Because these identifiers are treated as raw strings rather than parameterized values, an attacker can inject arbitrary SQL commands. Exploitation typically requires the application to pass user-controlled array structures into the query builder's join methods. To remediate this, developers should validate identifiers against an explicit schema allowlist and migrate to PDO prepared statements.
Affected products
- MixPHP MixPHP Framework 2.x through 2.2.17
Timeline
- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: CVE published to NVD