Summary
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
The rex_list component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable(). Although the value is wrapped in backticks via escapeIdentifier() (preventing classical SQL injection), this still allows any authenticated backend user to ORDER BY any column in the query's FROM tables, including unselected sensitive columns such as password from the rex_user table, and perform error-based column enumeration.
Details
File: redaxo/src/core/lib/list.php:976-982, getSortColumn() returns the raw request parameter without whitelist check:
public function getSortColumn($default = null)
{
if (rex_request('list', 'string') == $this->getName()) {
return rex_request('sort', 'string', $default); // NO validation against sortable columns
}
return $default;
}
File: redaxo/src/core/lib/list.php:899-911, prepareQuery() uses it directly in the ORDER BY clause:
protected function prepareQuery($query, array $defaultSort = [])
{
$sortColumn = $this->getSortColumn();
if ('' != $sortColumn) {
$sql = rex_sql::factory($this->db);
$sortColumn = $sql->escapeIdentifier($sortColumn); // backtick-wraps, but no whitelist
if ($defaultSort || false === stripos($query, ' ORDER BY ')) {
$query .= ' ORDER BY ' . $sortColumn . ' ' . $sortType;
}
}
The users list queries rex_user which contains password, previous_passwords, password_change_required, not in the SELECT. Specifying a non-existent column name produces a MySQL Unknown column exception whose message is propagated to the user, confirming or denying column existence.
PoC
Column enumeration (error-based):
GET /redaxo/index.php?page=users&list=<list_name>&sort=nonexistent_col&sorttype=asc
Response will contain: Unknown column 'nonexistent_col' in 'order clause'
Sort by password hash (data ordering leak):
GET /redaxo/index.php?page=users&list=<list_name>&sort=password&sorttype=asc
Users are silently reordered by their Argon2 password hash.
Impact
Authenticated backend users (non-admin) can enumerate database column names of internal tables via error messages and manipulate query ordering to include sensitive unselected columns. While this does not allow arbitrary SQL execution due to backtick escaping, it constitutes an information disclosure vulnerability enabling targeted further attacks.
The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.
CVE-2026-62998 has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.21.2); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Validate the sort request parameter against the whitelist of columns registered with setColumnSortable() before use in the query:
public function getSortColumn($default = null)
{
if (rex_request('list', 'string') == $this->getName()) {
$requested = rex_request('sort', 'string', $default);
if ($requested !== null && $this->hasColumnOption($requested, REX_LIST_OPT_SORT)) {
return $requested;
}
}
return $default;
}
Frequently Asked Questions
- What is CVE-2026-62998? CVE-2026-62998 is a medium-severity improper input validation vulnerability in redaxo/source (composer), affecting versions <= 5.21.1. It is fixed in 5.21.2. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
- How severe is CVE-2026-62998? CVE-2026-62998 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of redaxo/source are affected by CVE-2026-62998? redaxo/source (composer) versions <= 5.21.1 is affected.
- Is there a fix for CVE-2026-62998? Yes. CVE-2026-62998 is fixed in 5.21.2. Upgrade to this version or later.
- Is CVE-2026-62998 exploitable, and should I be worried? Whether CVE-2026-62998 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-62998 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-62998? Upgrade
redaxo/sourceto 5.21.2 or later.