Description (CNA)
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Friendica / Friendica | affected 0 through 2026.08-dev |
CWE
CWE-89
References
ADP enrichment
No English description supplied.
No references supplied.