CVE-2026-49491: Pixa Bank 2.0 SQL Injection via agence-ajax.php API

Synopsis

SQL injection in Pixa Bank 2.0 allows unauthenticated attackers to extract sensitive data from the application database by sending crafted POST requests to the agence-ajax.php endpoint. The vulnerability is reachable over the network and requires no credentials or user interaction, making it straightforward to exploit at scale. Successful exploitation reads stored user records including names, email addresses, and phone numbers. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The agence-ajax.php endpoint must be reachable over the network; the attacker sends crafted POST requests directly to the exposed service.

• AuthenticationNot required

  No credentials are needed; the vulnerable parameter is accessible to unauthenticated requests.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server endpoint without any involvement from a logged-in user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; crafting a UNION-based SQL payload against a known parameter requires no special timing or environmental setup.

Blast Radius

• Reads stored user records including full names, email addresses, and phone numbers from the database via UNION-based SQL extraction.
• Allows enumeration of database structure, which may expose additional tables and columns beyond the ones described in the advisory.
• Low integrity impact means an attacker may be able to write or manipulate limited data within the scope of the injectable query.