CVE-2026-38581: SQL Injection vulnerability in damasac thaipalliative_lte through version 3

Synopsis

SQL injection vulnerability in damasac thaipalliative_lte (through version 3.0) allows a remote, unauthenticated attacker to execute arbitrary SQL commands against the underlying database. The vulnerability is reachable over the network with no authentication required, by sending crafted values in the idFormMain parameter to /substudy/ezform.php or the id parameter at line 49, both of which are concatenated directly into SQL queries without sanitization or parameterized statements. Successful exploitation gives the attacker full read, write, and deletion access to the database, which may also enable operating-system-level code execution depending on database configuration. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoints are exposed over the network, so an attacker must be able to reach the application's HTTP interface to send crafted requests.

• AuthenticationNot required

  No account or credentials of any privilege level are needed; the vulnerable parameters are accessible to anonymous HTTP requests.

• Victim interactionNot required

  The attacker sends a malicious request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental prerequisites.

Blast Radius

• Reads all data stored in the database, including user records, session tokens, and any sensitive application data.
• Modifies or deletes persisted database rows, enabling data tampering or full destruction of application state.
• Depending on database server configuration and permissions, executes operating-system commands on the host running the database.
• Disrupts application availability by dropping tables or corrupting data structures critical to normal operation.