CVE-2026-72550 — Threat Intelligence Report

Executive Summary

CVE-2026-72550 is an unauthenticated SQL injection vulnerability in Friendica, an open-source federated social networking platform, affecting all versions up to and including the 2026.08-dev branch. The flaw resides in the photo-view functionality where an order parameter is concatenated unescaped into a SHOW COLUMNS query executed via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated remote attacker can execute arbitrary SQL statements against the underlying database, achieving full read, modify, and delete capabilities over all data stored by the Friendica instance. With a CVSS score of 9.8, this vulnerability poses a critical risk to any publicly exposed Friendica deployment.

Technical Analysis

The vulnerability is a classic SQL injection (CWE-89) with a critical twist: the injection surface is not a standard SELECT, INSERT, or UPDATE statement, but rather a SHOW COLUMNS query. According to the NVD description, the photo-view order parameter is concatenated directly — without any escaping, parameterization, or input validation — into a SHOW COLUMNS query. The query is then executed via a bare PDO::query() call.

Understanding the attack surface requires contextualizing the use of SHOW COLUMNS. In MySQL databases, SHOW COLUMNS is a meta-query used to retrieve column metadata for a specified table. The query has a syntax similar to:

SHOW COLUMNS FROM table_name [LIKE 'pattern']

The LIKE clause, and potentially other clauses in this query form, can accept user-controlled input. When that input is concatenated without escaping, it may permit a stack of additional SQL statements to be appended and executed sequentially — a technique known as stacked statement injection.

The PDO::query() method is significant because it executes a single SQL statement and returns a result set, but unlike PDO::prepare() with bound parameters, it does not provide any inherent separation between user input and the SQL structure. In PHP's PDO implementation, query() does not support multiple statements by default unless the PDO::MYSQL_ATTR_MULTI_STATEMENTS flag is enabled; however, the NVD description explicitly states that stacked statement injection is achievable, implying that the Friendica deployment configuration either enables multi-statements or the injection vector allows direct concatenation into a context where additional statements can be executed.

The specific vulnerable parameter is described as the "photo-view order parameter." This is an HTTP input parameter that a user supplies to control the sort order of photos in a viewing interface. The parameter value traverses the application's request handling and is eventually used in the construction of the SHOW COLUMNS query. The lack of any parameterization or escaping at this juncture allows an attacker to inject arbitrary SQL.

The impact scope is severe. The attacker is unauthenticated (CVSS vector AV:N/AC:L/PR:N/UI:N), meaning no login or session is required. The confidentiality, integrity, and availability impact are all rated HIGH (C:H/I:H/A:H). The attacker can read the entire database — including user credentials (password hashes), private messages, federation keys, and configuration data — modify records to manipulate platform behavior, and delete data to cause denial of service or data destruction. In a federated social network context, a database compromise could also enable identity spoofing, account takeover, and propagation of malicious content through the federation protocol.

Affected versions: The NVD description indicates "Friendica through the 2026.08-dev branch," meaning the vulnerability exists in all published stable releases and the current development branch as of the advisory date. No version-specific patch or fix has been identified.

Specific technical details — including the exact parameter name, the precise table targeted by SHOW COLUMNS, the complete query construction, and the HTTP route that reaches the vulnerable code — are not disclosed in the NVD description. The attack mechanism must therefore be inferred at the vulnerability-class level: any request to the photo-view functionality that includes an order parameter may trigger the injection.

Exploitation Scenarios

Step 1: Reconnaissance / Target Identification

An attacker identifies Friendica instances by scanning the internet for HTTP responses that reveal the platform. Friendica servers typically respond with identifiable headers, page titles, or HTML meta tags. Shodan dorks such as "Friendica" or "powered by Friendica" can enumerate exposed instances. The attacker targets any reachable instance — no authentication is required, so the attack surface includes all public-facing deployments.

Step 2: Triggering the Flaw

The attacker sends a crafted HTTP request to the photo-viewing endpoint, supplying a malicious value in the order parameter. For example, the request might be structured as:

GET /photo?order=<injection payload> HTTP/1.1
Host: target.friendica.instance

The exact URL path is not disclosed in the NVD data; however, any route that includes a photo-view feature with a sort-order parameter is a candidate vector. The application concatenates the supplied value directly into the SHOW COLUMNS query without sanitization, passing it to PDO::query().

Step 3: Payload / Execution Method

At the vulnerability-class level, the payload exploits stacked statement injection. A malicious order parameter value could contain:

• A terminator to close the initial SHOW COLUMNS statement (e.g., a semicolon).
• One or more fully-crafted SQL statements appended after the terminator.
• The appended statements executed sequentially against the database.

A representative payload structure (illustrative, not a verified value) might be:

legit_order; DROP TABLE users; --

or, for data extraction:

legit_order; SELECT username, password_hash FROM users INTO OUTFILE '/tmp/exfil.txt'; --

Since PDO::query() executes the SQL string, and the multi-statement execution capability is evidently enabled or inferred to be exploitable, the attacker controls the full SQL execution context. If multi-statement execution is not natively supported, the injection may still permit retrieval of arbitrary data by manipulating the existing query's clauses to alter the result set or bypass filters. However, the NVD description's explicit mention of "stacked statement injection" indicates that multiple statements can indeed be executed.

Step 4: Post-Exploitation Impact

Once arbitrary SQL execution is achieved, the attacker can:

• Read all tables: user accounts, password hashes, private messages, group memberships, federation keys, OAuth tokens, and application configuration.
• Modify records: change user roles to administrator, alter content, inject malicious payloads into stored fields (potentially leading to stored XSS or further exploitation), or tamper with federation data.
• Delete data: drop tables, truncate critical records, or overwrite configuration — causing persistent denial of service and data loss.

Given the federated nature of Friendica, a compromised instance's database could also be leveraged to send forged federation messages to other instances in the ActivityPub/DFRN network, potentially propagating malicious content or causing trust compromises with other servers.

Attack Chain Feasibility

No public PoC or exploit code is currently available (POC_STATUS: Unknown; no Nuclei template; no exploit code found). The attack is therefore inferred from the vulnerability description and known techniques for stacked SQL injection in PHP/MySQL applications. However, the vulnerability is trivially exploitable by any attacker with basic SQL injection knowledge. The lack of authentication requirements means the only barrier is technical skill in crafting the injection payload.

Impact Assessment

Business Impact

Friendica is a decentralized social networking platform that emphasizes user privacy and data ownership. A full database compromise directly contradicts those core promises, creating severe reputational damage and potential legal liability under data protection regulations such as GDPR. The database likely contains:

• User account data (email addresses, usernames, password hashes)
• Private communications (direct messages between users)
• Federated content and curation history
• Node configuration secrets (database credentials, federation keys)

Affected Systems

Any Friendica instance running a version up to and including the 2026.08-dev branch is affected. This includes all public-facing deployments regardless of hosting model (self-hosted, managed VPS, Docker, etc.). There is no known version that is patched — the highest affected version is the current development branch, and no subsequent fixed release has been identified.

Blast Radius

• Confidentiality (HIGH): Complete database read access.
• Integrity (HIGH): Complete database write/modify access — can alter any record, including privilege escalation.
• Availability (HIGH): Complete database delete/drop access — can cause persistent outage.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a network-exploitable, low-complexity, unauthenticated, high-impact attack affecting the target's confidentiality, integrity, and availability. The scope is Unchanged (S:U), meaning the compromise is confined to the vulnerable system, but the "system" here encompasses the entire database backend, which is the crown jewel of the application.

Business Criticality

For enterprise deployments where Friendica is used as a trusted communication channel, the ability for an attacker to impersonate users, read private communications, and destroy data represents a business continuity and legal compliance risk.

Detection Guidance

Sigma Rule

title: Friendica Photo-View SQL Injection Attempt
id: 6f02bfce-9c1a-4a5e-9f4f-2b6a6eed1c40
status: experimental
description: Detects HTTP requests to Friendica photo-view functionality containing suspicious SQL injection patterns in the order parameter.
author: Valters IT Security
date: 2026/05/20
logsource:
  category: webserver
  product: apache
detection:
  selection_url:
    http.url|contains:
      - '/photo'
  selection_sql_patterns:
    http.url|contains|windcard - not applicable - use regex:
      - '(?i)(%27|%22|%3B|%u0027|%u0022|%u003B)'
      - '(?i)(union|select|drop|insert|update|delete|sleep|benchmark|into|outfile|dumpfile|load_file)'
      - '(?i)(order\s+by|show\s+columns|information_schema|--|/\*|\*/|;.*--)'
  condition: selection_url and selection_sql_patterns
  timespan: 5m
falsepositives:
  - Legitimate administrative queries that happen to contain SQL keywords
  - Photo sorting by column names containing SQL-reserved words
level: high

YARA Rule

rule Friendica_SQLi_PhotoOrder_Request
{
    meta:
        author = "Valters IT Security"
        description = "Detects SQL injection payloads targeting Friendica photo-view order parameter"
        cve = "CVE-2026-72550"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72550"
        date = "2026-05-20"
        score = 80

    strings:
        $photo_path = "/photo" nocase
        $sql_union = "union" nocase
        $sql_select = "select" nocase
        $sql_show = "show columns" nocase
        $sql_drop = "drop" nocase
        $sql_sleep = "sleep" nocase
        $sql_comment = "--" ascii
        $sql_semicolon_stack = ";" ascii
        $url_encode_semi = "%3B" ascii
        $url_encode_quote = "%27" ascii
        $url_encode_double_quote = "%22" ascii

    condition:
        uint16(0) == 0x4745 and   // "GET"
        $photo_path and
        2 of ($sql_*)
        and any of ($url_encode_*)
        or ($photo_path and $sql_comment and $sql_semicolon_stack)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Friendica CVE-2026-72550 SQL Injection Attempt";
    flow:established,to_server;
    content:"/photo";
    http.uri;
    pcre:"/(?:%27|%22|%3B|%3b|%u0027|%u0022|%u003B)/Ui";
    pcre:"/(?:union|select|drop|insert|update|delete|sleep|benchmark|show\s+columns|order\s+by|--|\/\*|\*\/)/Ui";
    http.uri;
    classtype:web-application-attack;
    sid:20260825001;
    rev:1;
    metadata:created_at 2026_05_20, updated_at 2026_05_20, cve CVE-2026-72550;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and destination.port == 80 or destination.port == 443 ]
  [ http where http.request.method == "GET" and
    url.path contains "/photo" and
    (url.query contains "order=") and
    (
      url.query contains "%27" or
      url.query contains "%22" or
      url.query contains "%3B" or
      url.query contains "union" or
      url.query contains "select" or
      url.query contains "drop" or
      url.query contains "sleep" or
      url.query contains "--"
    )
  ]

Splunk SPL Query

index=web earliest=-24h
| where like(uri_path, "%/photo%") AND like(uri_query, "%order=%")
| eval malicious = case(
    like(uri_query, "%27") OR like(uri_query, "%22") OR like(uri_query, "%3B"),
    "url-encoding",
    like(lower(uri_query), "%union%") OR like(lower(uri_query), "%select%") OR like(lower(uri_query), "%drop%") OR like(lower(uri_query), "%sleep%") OR like(lower(uri_query), "%--%"),
    "sql-keyword",
    1=1, "")
| where malicious != ""
| stats count by src_ip, uri_path, uri_query, malicious
| sort - count
| table _time, src_ip, uri_path, uri_query, malicious, count

Wazuh OSSEC Rule

<group name="web,sql_injection,">
  <rule id="202650" level="12">
    <decoded_as>web</decoded_as>
    <match>photo</match>
    <regex>order=.*(%27|%22|%3B|%3b|%u0027|%u0022|%u003B|union|select|drop|sleep|--)</regex>
    <description>CVE-2026-72550 - Friendica SQL injection attempt in photo-view order parameter</description>
    <group>sql_injection,friendica,pci_dss_6.5,gdpr_32,att&ck.t1190</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Critical — unpatched. No fix is available. Patch confidence is rated 0/4; no patch evidence has been identified from any vendor advisory, GitHub commit, mailing list post, or security feed. The vulnerability affects all versions through the current 2026.08-dev branch, and no subsequent fixed release has been published.

Given the lack of a patch, the following measures are recommended:

1. Immediate Mitigations (Risk Reduction)

• Restrict network exposure: Place any Friendica instance behind a reverse proxy or firewall that restricts access to the photo-view endpoint. If the photo-viewer is not critical to internal operations, block access to it entirely.
• Web Application Firewall (WAF) rules: Deploy WAF rules that block requests to any Friendica endpoint containing SQL metacharacters in query parameters, particularly the order parameter. Use the Sigma rule patterns above as WAF rule templates.
• Database minimization: Run the Friendica database as a least-privilege account. Ensure the application's MySQL user does not have FILE, GRANT, or DROP privileges. Restrict the account to only the operations required for normal application function (e.g., SELECT, INSERT, UPDATE, DELETE on specific tables). This reduces but does not eliminate impact.
• Disable multi-statement execution: If using MySQL with PDO, ensure the PDO::MYSQL_ATTR_MULTI_STATEMENTS flag is disabled, if possible. This may prevent stacked statement injection from executing additional queries, though the NVD description suggests multi-statement execution is viable in the default configuration.
• Database backup: Take frequent, verified backups of the database. Ensure point-in-time recovery is possible.
• Monitor aggressive alerting: Enable alerting on the detection rules above. Investigate any request containing SQL keywords to the photo endpoints.

2. Patch/Upgrade Steps

• Monitor vendor channels: Actively monitor friendica.org, the Friendica GitHub repository, and the Friendica development mailing lists for a security advisory or patched release. Subscribe to security feeds.
• Version upgrade: When a patched version is released (likely following the 2026.08-dev branch), upgrade all affected instances immediately. Test the upgrade in a staging environment first.
• Temporary code mitigation (if self-managed): If you operate the Friendica codebase yourself, review the photo-view code path and apply input validation on the order parameter. Do not rely on generic string escaping — use prepared statements with bound parameters or at minimum whitelist valid order values (e.g., ASC, DESC, specific column names). This is a temporary measure until the official fix is released.

3. Long-Term Hardening

• Parameterized queries: Ensure all database access throughout the application uses prepared statements with bound parameters exclusively. Eliminate any remaining PDO::query() calls that incorporate user input.
• Input validation: Implement strict allowlist validation for all user-supplied parameters that interact with database queries — not just the one found vulnerable, but the entire application surface.
• Penetration testing: Conduct systematic penetration testing of the Friendly application, focusing on all database-bound parameters, after the patch is applied.
• Principle of least privilege: Ensure the application's database account has the minimum privileges required. For a social platform, the account typically needs SELECT, INSERT, UPDATE, DELETE on application-specific tables. Avoid granting DROP, ALTER, GRANT, or FILE.
• Incident response readiness: Prepare a database recovery playbook, since data destruction is a realistic impact of this vulnerability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72550 — Official CVE record with description, CVSS 9.8 vector, and references.

2. Friendica Project: https://friendica.org — Official project website. Monitor for security advisories and patched releases.

3. Friendica GitHub Repository: https://github.com/friendica/friendica — Source code repository. Monitor commit history and security branches for the pending fix.

4. CWE-89 (SQL Injection): https://cwe.mitre.org/data/definitions/89.html — MITRE weakness description for SQL injection.

5. ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application, the technique mapping for this vulnerability.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:

As of the publication date, no known threat actor campaign has been attributed to this CVE, and there is no evidence of exploitation in the wild. However, given the critical severity, unauthenticated access vector, and the straightforward exploitation technique (stacked SQL injection requiring only HTTP request manipulation), active exploitation attempts are considered probable once a PoC circulates or the vulnerability becomes publicly known. Enterprise teams should treat any unpatched Friendica instance as critically exposed.