Executive Summary
The CVE-2026-6982 vulnerability poses a medium-severity threat due to its potential for SQL injection attacks, which could lead to data breaches or system compromise. Exploitation likelihood is considered moderate given the need for an attacker to manipulate specific arguments. However, the business impact could be significant if sensitive data is accessed or modified.
Enhanced Description
The vulnerability identified as CVE-2026-6982 affects versions of star7th ShowDoc up to 2.10.10, 3.6.2, and 3.8.0. It is specifically related to an unknown functionality within the PageController.class.PHP file, which is part of the API Page Sort Endpoint. An attacker can exploit this vulnerability by manipulating the 'pages' argument, leading to a SQL injection attack. This type of attack can be launched remotely, meaning an attacker does not need direct access to the system to exploit the vulnerability. The potential impact of a successful attack could include unauthorized data access, modification, or even deletion, depending on the privileges of the database user. Furthermore, SQL injection attacks can also be used to execute system-level commands in some cases, potentially leading to a complete system compromise. Upgrading to version 3.8.1 or later is recommended as it addresses this issue, although the vendor has stated that patches will not be backported to older affected versions.
Exploitation Context
Realistic exploitation scenarios include attackers targeting unprotected API endpoints to inject malicious SQL code, potentially leading to unauthorized data access or system compromise. Attackers may be motivated by the desire to steal sensitive information, disrupt operations, or use the compromised system as a stepping stone for further attacks.
Patch Priority
Recommended Actions
Suggested Tags
Confidence Assessment
The confidence in the severity rating and exploitation likelihood is high due to the clear description of the vulnerability and the potential impact of a SQL injection attack. However, the exploitation likelihood might be influenced by factors such as the presence of other security controls or the attractiveness of the target to potential attackers.
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."
15.5th percentile