CVE-2026-42550— Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42550
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Source: NVD (National Vulnerability Database)
Vulnerability Description
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Flight SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Flight是Mike Cao个人开发者的一个PHP微框架。 Flight 3.18.1之前版本存在SQL注入漏洞，该漏洞源于SimplePdo::insert()、SimplePdo::update()和SimplePdo::delete()将$table参数和$data数组的键直接拼接至SQL语句，未进行标识符引用和验证，可能导致SQL注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-42550
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42550
请登录查看更多情报信息。
- https://github.com/flightphp/core/security/advisories/GHSA-xwqr-rcqg-22mrx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-42550
Same Patch Batch · flightphp · 2026-05-13 · 5 CVEs total
| CVE-2026-42552 | 7.5 HIGH | Flight: Sensitive information disclosure via default error handler in flightphp/core |
| CVE-2026-42551 | 7.5 HIGH | Flight: HTTP method override enabled by default enables CSRF escalation and middleware byp |
| CVE-2026-42549 | 4.4 MEDIUM | Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside proj |
| CVE-2026-42548 | Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() |
IV. Related Vulnerabilities
Same product: core
- CVE-2026-45158
OPNsense: Command Injection via Attacker-Controlled DHCP Con - CVE-2026-44194
OPNsense: RCE on user managment - CVE-2026-44195
OPNsense: Authentication lockout bypass - CVE-2026-44193
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_co - CVE-2026-42552
Flight: Sensitive information disclosure via default error h
Same vendor: flightphp
- CVE-2026-42552
Flight: Sensitive information disclosure via default error h - CVE-2026-42551
Flight: HTTP method override enabled by default enables CSRF - CVE-2026-42549
Flight: Path traversal in `make:controller` CLI creates arbi - CVE-2026-42548
Flight: Reflected XSS via unvalidated JSONP callback in Flig - CVE-2014-125127
Denial of Service (DoS) vulnerability in mikecao/flight
Same weakness: CWE-89
- CVE-2018-25339
Zechat 1.5 SQL Injection via v parameter (time-based blind) - CVE-2018-25338
Zechat 1.5 SQL Injection via hashtag parameter - CVE-2018-25333
Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection - CVE-2018-25330
Joomla! EkRishta 2.10 Persistent XSS and SQL Injection - CVE-2018-25319
Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.
V. Comments for CVE-2026-42550
No comments yet