Executive brief
REDAXO is a content management system used to manage website content and backend users. An authenticated backend user can manipulate database query sorting to access sensitive unselected columns (such as password hashes and internal metadata) and enumerate database column names through error messages, potentially enabling targeted attacks against administrative accounts.
Technical details
The vulnerability is an insufficient input validation flaw in the `rex_list` component (file `redaxo/src/core/lib/list.php`). The `getSortColumn()` method reads the `sort` GET parameter and passes it directly to the ORDER BY clause without checking it against the whitelist of columns registered via `setColumnSortable()`. Although the column name is wrapped in backticks via `escapeIdentifier()` to prevent classical SQL injection, an attacker can still order results by any column in the underlying tables, including sensitive unselected columns like `password`, `previous_passwords`, and `password_change_required` from the `rex_user` table. An error-based enumeration technique allows authenticated backend users to determine column existence by observing database error messages (e.g., "Unknown column in 'order clause'"). Attack requires authentication to the backend and knowledge of table names; no special privileges or user interaction are needed beyond crafting GET requests.
Affected products
- REDAXO REDAXO <UNKNOWN>
Timeline
- 2026-09-24: disclosed: GHSA-4f5f-j737-pm58 published
- 2026-09-24: advisory