Unpatched SQLi Hits Raytha CMS OData Filter
Raytha CMS 1.5.2 has an unauthenticated SQL injection flaw in its OData filter parsing that can lead to full PostgreSQL database compromise.
CERT Polska coordinated the disclosure of CVE-2026-12076, a SQL injection vulnerability in Raytha CMS affecting the OData filter parsing pipeline. The flaw allows a remote, unauthenticated attacker to inject arbitrary SQL statements against the backend PostgreSQL database, potentially resulting in full database compromise including extraction of stored credentials.
The vulnerability has been confirmed in Raytha CMS version 1.5.2; other versions may also be affected but could not be verified as vendor contact attempts were unsuccessful, meaning no patch is currently available. Organizations running Raytha CMS should treat any OData filter input as untrusted and consider additional mitigations such as web application firewalls or restricting external access until a fix is released. The report credits researcher Arkadiusz Marta for responsible disclosure through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
SQL Injection Attempt in OData Filter Parameter
Detects SQL injection payloads in OData filter parameters targeting Raytha CMS, using common SQLi syntax markers in query strings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Attempt in OData Filter Parameter
description: Detects potential SQL injection attacks against Raytha CMS OData filter
endpoint by identifying characteristic SQLi syntax in HTTP query parameters, including
UNION-based, time-based, and boolean-based injection markers.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: web_application_firewall
product: generic
detection:
selection:
http_request_uri|contains:
- ?$filter=
- filter=
http_request_uri|re: (union.*select|select.*from|\bor\b.*=.*|\band\b.*=.*|\bxp_|\bsp_|sleep\(|benchmark\(|waitfor.*delay|cast\(|convert\()
filter_legit_odata:
http_request_uri|contains:
- $filter=substringof
- $filter=startswith
- $filter=endswith
- $filter=length
condition: selection and not filter_legit_odata
falsepositives:
- Legitimate OData queries using complex filtering with OR/AND operators
- Web application firewalls may flag benign parameterized queries that happen to contain
SQL keywords
level: high
id: 66573efc-caf7-59e7-a608-5ec37e308afb
status: experimental
author: Vorant
Raytha CMS OData Endpoint Exploitation Attempt
Detects HTTP POST/GET requests to Raytha CMS OData filter endpoints with suspicious parameter manipulation or filter chain injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Raytha CMS OData Endpoint Exploitation Attempt
description: Detects attempts to exploit CVE-2026-12076 by identifying suspicious
access patterns to OData filter parsing endpoints in Raytha CMS, particularly unauthenticated
requests with encoded or obfuscated payloads.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: web_application_firewall
product: generic
detection:
selection:
http_request_uri|contains:
- /api/odata
- /$filter=
http_method:
- GET
- POST
http_user_agent|contains:
- sqlmap
- nikto
- burpsuite
- havij
selection_alt:
http_request_uri|contains:
- /api/odata
- /$filter=
http_status_code:
- 200
- 500
http_request_body|contains:
- /**/
- (select
- pg_sleep
- information_schema
condition: selection or selection_alt
falsepositives:
- Legitimate API testing tools used by development teams
- Database error pages exposed in 500 responses may contain benign keywords
level: medium
id: 5e8a61bd-0445-5a7a-a393-8d2824ab2f94
status: experimental
author: Vorant
Database Credential Extraction from Raytha CMS Backend
Detects successful database query results containing credential-like strings being returned from Raytha CMS following OData filter exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Database Credential Extraction from Raytha CMS Backend
description: Detects HTTP responses from Raytha CMS OData endpoints containing database
records with credential patterns (passwords, API keys, connection strings), suggesting
successful SQLi-based data exfiltration.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: web_application_firewall
product: generic
detection:
selection:
http_request_uri|contains:
- /api/odata
- /$filter=
http_status_code: 200
http_response_body|re: (password|passwd|pwd|secret|apikey|api_key|token|bearer|connection_string).*[:=].*[a-zA-Z0-9!@#$%^&*]{8,}
filter_admin_export:
http_user_agent|contains:
- Raytha-Admin
- RayService
condition: selection and not filter_admin_export
falsepositives:
- Legitimate administrative API responses that include masked/redacted credentials
- API documentation or schema endpoints that reference credential field names
level: high
id: 8695988a-e65f-5728-b0b9-95b791adadd1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-12076
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free