Raytha CMS SQLi enables unauthenticated database takeover
CVE-2026-12076 in Raytha CMS allows unauthenticated attackers to execute arbitrary SQL via OData filter parsing, compromising the PostgreSQL database.
CERT Polska has disclosed CVE-2026-12076, a critical SQL injection vulnerability in Raytha CMS that resides within the OData filter parsing pipeline. The flaw allows remote, unauthenticated attackers to execute arbitrary SQL statements against the underlying PostgreSQL database, resulting in full database compromise including credential extraction.
The vulnerability was responsibly reported by researcher Arkadiusz Marta. CERT Polska participated in coordinating the disclosure, though vendor contact attempts were unsuccessful. The vulnerability has been confirmed in Raytha CMS version 1.5.2, and may affect other versions as well.
Organizations running Raytha CMS should treat this as an urgent patching priority given the unauthenticated remote exploitation vector and the potential for complete database takeover. Until a patch is available, consider restricting access to the CMS or taking affected instances offline.
Mentioned in this report
Detection guidance
Possible SQL Injection via OData $filter Parameter on Raytha CMS
Detects HTTP requests containing SQL injection payload patterns within the OData $filter query parameter, consistent with CVE-2026-12076 exploitation against Raytha CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible SQL Injection via OData $filter Parameter on Raytha CMS
id: e10611ea-5c24-55b2-9b52-9638922d6066
status: experimental
description: 'Detects HTTP requests where the OData $filter query parameter contains
SQL injection
patterns such as UNION SELECT, boolean-based tautologies, SLEEP/pg_sleep calls,
or
information_schema references. This matches the exploitation pattern for CVE-2026-12076,
an unauthenticated SQL injection in Raytha CMS''s OData filter parsing pipeline.
'
references:
- CVE-2026-12076
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_filter_param:
cs-uri-query|contains: $filter=
selection_sqli_patterns:
cs-uri-query|contains:
- UNION SELECT
- union select
- ' OR 1=1'
- ''' OR ''1''=''1'
- pg_sleep(
- SLEEP(
- information_schema
- pg_catalog
- --
- xp_cmdshell
- CAST(
- CONVERT(
condition: selection_filter_param and selection_sqli_patterns
falsepositives:
- Legitimate OData clients using CAST or CONVERT for type coercion in filters
- Security scanners or penetration testing tools probing the endpoint
level: high
PostgreSQL Error Disclosure in Web Response Following OData Query
Detects web server responses containing PostgreSQL error messages returned to the client following an OData filter request, indicating a likely successful or attempted SQL injection probe. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PostgreSQL Error Disclosure in Web Response Following OData Query
id: 42b7be2e-3112-5966-a812-50f2afbddc81
status: experimental
description: 'Detects HTTP responses that expose raw PostgreSQL error messages (e.g.
syntax errors,
relation/column errors) in the response body after a request to an OData-style endpoint
with a $filter parameter. This behaviour indicates SQL injection probing or exploitation
attempts such as CVE-2026-12076 against Raytha CMS.
'
references:
- CVE-2026-12076
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_request:
cs-uri-query|contains: $filter=
selection_error_body:
cs-uri-query|contains:
- 'ERROR:'
- syntax error at or near
- 'PG::'
- Npgsql.PostgresException
- relation "
- column "
condition: selection_request and selection_error_body
falsepositives:
- Application debug/verbose error pages inadvertently enabled in non-production environments
- Automated vulnerability scanners intentionally triggering and logging error responses
level: medium
High Volume of OData Filter Requests to Single CMS Endpoint
Detects a burst of distinct OData $filter query requests to the same CMS endpoint from a single source, consistent with automated SQL injection exploitation or scanning of the Raytha CMS OData filter parsing pipeline. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: High Volume of OData Filter Requests to Single CMS Endpoint
id: 782c8da9-54e0-52e4-899f-dc7bab183977
status: experimental
description: 'Detects repeated requests containing OData $filter parameters directed
at the same URI
path, which is characteristic of automated SQL injection exploitation tooling (e.g.
sqlmap)
attempting to enumerate database contents through CVE-2026-12076. Note: this rule
flags
individual matching requests; analysts should correlate volume/frequency from the
same
source IP within a short window (e.g. tens of requests per minute) to confirm automated
exploitation versus a single manual test.
'
references:
- CVE-2026-12076
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_odata_filter:
cs-uri-query|contains: $filter=
selection_tooling_ua:
c-useragent|contains:
- sqlmap
- curl/
- python-requests
condition: selection_odata_filter and selection_tooling_ua
falsepositives:
- Internal automation or monitoring scripts using curl/python-requests to legitimately
query OData endpoints
- Authorized security testing against the CMS
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-12076/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free