Executive brief
The Database plugin for Grav CMS, which provides database connectivity for the platform, contains a security flaw in how it checks for the existence of database tables. If a third-party plugin or custom code uses this function with data provided by a user, an attacker could execute unauthorized database commands. This could lead to the theft of sensitive customer data, modification of website content, or full takeover of the database.
Technical details
A SQL injection vulnerability exists in the `PDO::tableExists` method of the `grav-plugin-database` plugin. The root cause is the direct interpolation of the `$table` argument into a raw SQL query string (`SELECT 1 FROM $table LIMIT 1`) without sanitization, escaping, or whitelisting. While the method is a utility for other plugins, any consuming code that passes attacker-controlled input to this method enables unauthenticated arbitrary SQL execution. Depending on the database driver (SQLite, MySQL, PostgreSQL), this can lead to multi-statement execution, data exfiltration via UNION SELECT, or file system interaction. The issue is resolved in version 1.2.0 by implementing parameterized, driver-aware catalog lookups.
Affected products
- getgrav grav-plugin-database < 1.2.0
Timeline
- 2026-06-18: patched: Fix committed and version 1.2.0 released
- 2026-07-10: disclosed: Advisory published and CVE assigned