Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107803— ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

Quick assessment

Affected
ProcessMaker processmaker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ProcessMaker 是一款开源的工作流管理软件套件。在版本 2026.14.3 之前，ProcessMaker 的 接口存在 SQL 注入漏洞。该漏洞源于 方法中，将一个由用户可控的 表列名直接拼接到 构造的 SQL 子查询中，且未进行任何输入验证或使用参数化绑定。任何已认证用户均可利用基于时间的盲注技术，推断并提取 ProcessMaker 数据库账户可访问的数据。该问题已在版本 2026.14.3 中得到修复。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
ProcessMaker processmaker < 2026.14.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107803

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter
Source: CVE Program / CVE List V5
Vulnerability Description
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ProcessMaker processmaker < 2026.14.3 -

II. Public POCs for CVE-2026-107803

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107803

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-107803 (2)

Vendor Advisories for CVE-2026-107803 (1)

Vendor Pages for CVE-2026-107803 (1)

IV. Related Vulnerabilities

Same product: processmaker
Same vendor: ProcessMaker
Same weakness: CWE-89

V. Comments for CVE-2026-107803

No comments yet

Leave a comment