PHPOK: SQL injection via sort parameter in api.php
Summary
PHPOK versions from 4.5.000 up to before 5.4.081 contain an SQL injection flaw in the sort parameter of the public API endpoint /api.php. An unauthenticated remote attacker can send crafted GET requests to manipulate ORDER BY clauses and extract database contents through error messages. The CVSS 4.0 base score is 8.8, with high confidentiality impact on the database.
Affected
- PHPOK 4.5.000 to before 5.4.081
- Endpoint: /api.php?c=project&f=index, parameter sort
Fixed in
- Upgrade to PHPOK 5.4.081 or later (vendor commit d70c396f)
Workaround
- No vendor-documented workaround. Unknown.
- Interim: restrict or block public access to the vulnerable endpoint at the web server or WAF (own recommendation, not from the vendor).
Exploitation
- No authentication required; exploitable over the network via GET requests.
- A public Nuclei detection template exists, which lowers the effort to scan for the flaw.
- Known exploitation status is conflicting between sources; not confirmed by CISA KEV in this review.
- The first-observation date given in the CVE description (2023-10-14, Shadowserver) could not be verified.
Our recommendation
- Inventory all PHPOK installations and check their versions.
- Upgrade affected instances to 5.4.081 or later, prioritising internet-facing systems.
- Until patched, restrict access to /api.php at the web server or WAF.
- Review web and database logs for errors related to the sort parameter.
- If exposure is suspected, rotate database and administrator credentials and check for data extraction.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- VulDB entry 425257 vuldb.com
- PHPOK vendor commit d70c396f github.com
- Nuclei detection template github.com
- HOL Guard CVE page hol.org
- Strix CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:57.
Original description (NVD)
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.