Read the docs
TI-2022-26711 Aliases CVE-2022-51023GHSA-hv8g-4wwm-c979

SQL injection in PHPOK via the api.php sort parameter

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

PHPOK from 4.5.000 before 5.4.081 contains an SQL injection flaw in the sort parameter of api.php, tracked as CWE-89. An unauthenticated remote attacker can manipulate ORDER BY clauses by sending crafted GET requests and extract database information through error messages. The Shadowserver Foundation first observed exploitation evidence on 2023-10-14.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Fix Fixed PHPOK (PHPOK): 5.4.081

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHPOKPHPOK4.5.000 to before 5.4.0815.4.081Patch availableCNA
  • PHPOK VendorPHPOK Affected 4.5.000 to before 5.4.081 Fixed in 5.4.081 Patch available CNA

Remediation

Upgrade PHPOK to version 5.4.081 or later, the fixed version listed for this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA PHPOK (PHPOK) Fixed in 5.4.081

Timeline

  1. 2026-10-22 Threatist record created from CVE-2022-51023
  2. 2026-10-22 Alias added: GHSA-hv8g-4wwm-c979
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → MEDIUM

References

Patch 1

Other 1

  • TI-2022-19467 Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-16596 An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows… CVSS 3.1HIGH 8.8
  • TI-2021-13263 File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code… CVSS 3.1HIGH 8.8
  • TI-2024-30027 phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php. CVSS 3.1HIGH 7.5
  • TI-2020-14064 SQL injection vulnerability in PHPOK v.5.4. CVSS 3.1HIGH 7.5
  • TI-2023-02707 PHPOK unrestricted upload CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences