CVE-2026-8133 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Nature**: `admin.php` parameter order manipulation → **SQL Injection** 💥 **Consequence**: Remote attackers can read/modify the database 📉 Causing information leakage or damage

Q: Root Cause? (CWE/Flaw)

🔍 **Root Cause**: Parameter order manipulation ⚠️ Suspected **CWE-89**: SQL Injection 📌 Vulnerability Point: Unknown function in `dzz/shares/admin.php`

Q: Who is affected? (Versions/Components)

🎯 **Affected Versions**: zyx0814 FilePress ≤ **2.2.0** 🧩 **Affected Component**: Shares Filelist API ➡️ `admin.php`

Q: What can hackers do? (Privileges/Data)

👤 **Privileges**: No login required 🚪 🗃️ **Accessible Data**: Database content 📉 Risk: Data theft, tampering, or destruction

Q: Is exploitation threshold high? (Auth/Config)

✅ **Low Exploitation Threshold** 🌐 **Remote** ✔️ 🔓 **No Authentication Required** (PR:N / UI:N) ⚙️ Triggerable with default configuration

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧨 **Existing Exploit Available**! 📂 PoC on GitHub 🔗 `Web-Security-Research/FilePress/Shares-API-PreAuth-SQLi` 📢 Exploitation code is publicly available 🚨

Q: How to self-check? (Features/Scanning)

🔎 **Self-Check Method**: - Check if using FilePress ≤ 2.2.0 ❗ - Locate `dzz/shares/admin.php` 📁 - Search for unfiltered parameter concatenation 🧵 - Test for abnormal responses using known requests 🧪

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **Officially Patched** ✅ 📌 Patch Hash: `e20ec58414103f781858f2951d178e19b1736664` 🔗 GitHub commit & PR published 🔧

Q: What if no patch? (Workaround)

⚠️ **Before Patching**: - Restrict access to `admin.php` 🚧 IP whitelist - Disable Shares Filelist API ❌ - Use Web Application Firewall to block suspicious parameters 🧱

Q: Is it urgent? (Priority Suggestion)

🔥 **High Priority**! 📈 CVSS: **6.3** (L/L/L) 📢 Easy to exploit + Public Exploit ➕ Remote Unauthenticated 💡 Recommendation: Apply patch immediately or implement temporary protection 🚨

Updated May 08, 2026 CVSS 7.3 · High

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Nature**: `admin.php` parameter order manipulation → **SQL Injection**
💥 **Consequence**: Remote attackers can read/modify the database 📉 Causing information leakage or damage

Q2Root Cause? (CWE/Flaw)

🔍 **Root Cause**: Parameter order manipulation
⚠️ Suspected **CWE-89**: SQL Injection
📌 Vulnerability Point: Unknown function in `dzz/shares/admin.php`

Q3Who is affected? (Versions/Components)

🎯 **Affected Versions**: zyx0814 FilePress ≤ **2.2.0**
🧩 **Affected Component**: Shares Filelist API ➡️ `admin.php`

Q4What can hackers do? (Privileges/Data)

👤 **Privileges**: No login required 🚪
🗃️ **Accessible Data**: Database content
📉 Risk: Data theft, tampering, or destruction

Q5Is exploitation threshold high? (Auth/Config)

✅ **Low Exploitation Threshold**
🌐 **Remote** ✔️
🔓 **No Authentication Required** (PR:N / UI:N)
⚙️ Triggerable with default configuration

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧨 **Existing Exploit Available**!
📂 PoC on GitHub 🔗 `Web-Security-Research/FilePress/Shares-API-PreAuth-SQLi`
📢 Exploitation code is publicly available 🚨

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check Method**:
- Check if using FilePress ≤ 2.2.0 ❗
- Locate `dzz/shares/admin.php` 📁
- Search for unfiltered parameter concatenation 🧵
- Test for abnormal responses using known requests 🧪

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Officially Patched** ✅
📌 Patch Hash: `e20ec58414103f781858f2951d178e19b1736664`
🔗 GitHub commit & PR published 🔧

Q9What if no patch? (Workaround)

⚠️ **Before Patching**:
- Restrict access to `admin.php` 🚧 IP whitelist
- Disable Shares Filelist API ❌
- Use Web Application Firewall to block suspicious parameters 🧱

Q10Is it urgent? (Priority Suggestion)

🔥 **High Priority**!
📈 CVSS: **6.3** (L/L/L)
📢 Easy to exploit + Public Exploit ➕ Remote Unauthenticated
💡 Recommendation: Apply patch immediately or implement temporary protection 🚨

Continue exploring

Vulnerability detail Full AI analysis (login) zyx0814 CWE-89