CVE-2026-28226

Summary

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through RemapOrderBy(), an authenticated attacker can inject SQL expressions into the ORDER BY clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

Affected Software

VendorProductVersion RangeStatus
phishingclubphishingclub< 1.30.2affected

Weaknesses

  • CWE-89: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References