GCVE-1988-2026-0245

Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:22
VLAI
Title
[KIS-2026-08] SocialEngine <= 7.8.0 (get-memberall) SQL Injection Vulnerability
Summary
----------------------------------------------------------------- SocialEngine <= 7.8.0 (get-memberall) SQL Injection Vulnerability ----------------------------------------------------------------- [-] Software Link: https://socialengine.com [-] Affected Versions: Versions 7.8.0, 7.7.0, and likely prior versions. [-] Vulnerability Description: User input passed through the "text" request parameter to the /activity/index/get-memberall endpoint is not properly sanitized before being used to construct an SQL query. This can be exploited by remote, unauthenticated attackers to read arbitrary, sensitive data from the underlying database through in-band SQL Injection attacks. NOTE: this might also be exploited to reset admin users' passwords and gain unauthorized access to the "Packages Manager" in the Admin Panel, in order to achieve Remote Code Execution (RCE). [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2026-41460.php [-] Solution: No official solution is currently available. [-] Disclosure Timeline: [02/02/2026] - Vulnerability confirmed on version 7.7.0 [02/02/2026] - Vendor notified [09/02/2026] - Vendor response stating "We are currently validating your report... If this issue is confirmed, we will prioritize appropriate fixes and include them in an upcoming update." [27/02/2026] - Vendor released version 7.8.0, but the vulnerability is still not fixed [02/03/2026] - Vendor contacted again [09/03/2026] - Vendor response stating "We will check and update you." [23/03/2026] - Vendor notified about 60-day disclosure deadline policy [25/03/2026] - Vendor said this issue has been fixed on the demo website, and invited me to test it [25/03/2026] - Vendor was informed the demo website looks not vulnerable anymore [03/04/2026] - Reached 60-day disclosure deadline, still no official solution [21/04/2026] - CVE identifier requested [22/04/2026] - CVE identifier assigned [23/04/2026] - Public disclosure [-] CVE Reference: CVE-2026-41460 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-08 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Socialengine Socialengine Affected: unknown
guessed Create a notification for this product.
Credits
Egidio Romano
Relationships
reference GCVE-1988-2026-0245 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Socialengine",
          "vendor": "Socialengine",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----------------------------------------------------------------\nSocialEngine \u003c= 7.8.0 (get-memberall) SQL Injection Vulnerability\n-----------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://socialengine.com\n\n\n[-] Affected Versions:\n\nVersions 7.8.0, 7.7.0, and likely prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"text\" request parameter to the\n/activity/index/get-memberall endpoint is not properly sanitized\nbefore being used to construct an SQL query. This can be exploited by\nremote, unauthenticated attackers to read arbitrary, sensitive data\nfrom the underlying database through in-band SQL Injection attacks.\n\nNOTE: this might also be exploited to reset admin users\u0027 passwords and\ngain unauthorized access to the \"Packages Manager\" in the Admin Panel,\nin order to achieve Remote Code Execution (RCE).\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-41460.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[02/02/2026] - Vulnerability confirmed on version 7.7.0\n\n[02/02/2026] - Vendor notified\n\n[09/02/2026] - Vendor response stating \"We are currently validating\nyour report... If this issue is confirmed, we will prioritize\nappropriate fixes and include them in an upcoming update.\"\n\n[27/02/2026] - Vendor released version 7.8.0, but the vulnerability is\nstill not fixed\n\n[02/03/2026] - Vendor contacted again\n\n[09/03/2026] - Vendor response stating \"We will check and update you.\"\n\n[23/03/2026] - Vendor notified about 60-day disclosure deadline policy\n\n[25/03/2026] - Vendor said this issue has been fixed on the demo\nwebsite, and invited me to test it\n\n[25/03/2026] - Vendor was informed the demo website looks not vulnerable anymore\n\n[03/04/2026] - Reached 60-day disclosure deadline, still no official solution\n\n[21/04/2026] - CVE identifier requested\n\n[22/04/2026] - CVE identifier assigned\n\n[23/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-41460 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-08\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:22:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/12"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-08"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-41460.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://socialengine.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-08] SocialEngine \u003c= 7.8.0 (get-memberall) SQL Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-41460",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0245",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/12",
            "automated": true,
            "contentSha256": "a7b3eff881a146c7997812213336a0c6c77b7f19320e3598193d059c3046c50b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T09:15:04Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0245"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:22:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0245"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.