Executive brief
FilePress is an open-source file-driven website building system. A SQL injection vulnerability in its Publish Module allows attackers to extract sensitive data from the database, including user credentials and file metadata. In public-mode deployments, the attack requires no authentication and can be executed remotely.
Technical details
The Publish Module fails to validate or sanitize the orderby and order GET parameters before concatenating them into SQL ORDER BY clauses across four files (dzz/publish/search.php, dzz/publish/ajax.php, dzz/publish/robot/collect.php, and dzz/banner/robot/publish/collect.php). Attackers bypass the prepended table prefix (p.) using comma-based injection, allowing time-based blind SQL injection payloads. In default mode, exploitation requires a low-privilege read2 session; in public mode (overt=true), no authentication is needed. Successful exploitation enables full database extraction, credential theft, and potential remote code execution via INTO OUTFILE if MySQL FILE privileges are enabled. A patch with whitelist validation has been recommended but not yet deployed by the project.
Affected products
- zyx0814 FilePress up to 3.0.1
Timeline
- 2026-08-14: disclosed: Vulnerability reported via GitHub issue #74
- 2026-09-15: advisory: CVE-2026-90879 published