{"id":"CVE-2026-71245","published":"2026-08-05T11:16:27.487","lastModified":"2026-08-10T12:17:27.077","description":"Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mautic/mautic","tags":[]}],"exploitRefs":[{"url":"https://github.com/mautic/mautic","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows SQL injection by improperly sanitizing user input and directly concatenating it into a SQL query.","exploitability":"Exploitation is relatively easy given that no thorough validation or parameter binding is used.","blast_radius":"If exploited, this could lead to unauthorized data access or manipulation in the Mautic application database.","remediation":"Implement proper input validation and use parameterized queries to prevent SQL injection.","tags":["sql-injection","rce","web","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T07:03:56.727Z"}}