CVE-2026-12076: SQL Injection in Raytha CMS

Synopsis

SQL injection in Raytha CMS (version 1.5.2 confirmed) allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying PostgreSQL database by sending crafted OData filter parameters over the network. No authentication or victim interaction is required. Successful exploitation gives the attacker full read, write, and destructive access to every row in the database, including stored credentials. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Raytha HTTP service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  The OData filter endpoint is exposed without authentication, so any unauthenticated client can send a malicious payload.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low: the exploit is reliable and condition-free, requiring no race conditions, memory-layout knowledge, or special environmental state.

Blast Radius

• Reads all data stored in the PostgreSQL database, including hashed or plaintext credentials, session tokens, and application records.
• Modifies or deletes arbitrary database rows, enabling content tampering, account takeover, or wholesale data destruction.
• Extracts credentials that may enable lateral movement into other internal systems if passwords are reused.
• Crashes or corrupts database state in ways that bring the Raytha application offline.