SQL Injection in Friendica Photo View Order Parameter

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Friendica, a decentralized social networking platform, contains a critical SQL injection vulnerability (CVSS 9.8) in its photo-view functionality where user-supplied input is directly concatenated into database queries without sanitization. An unauthenticated attacker can exploit the unescaped order parameter to inject arbitrary SQL statements through a bare PDO::query() call, enabling stacked query execution. This allows complete database compromise—attackers can read sensitive user data, modify records, delete content, or potentially escalate privileges. The vulnerability affects the 2026.08-dev branch and any systems running vulnerable versions, creating immediate risk for all Friendica deployments and their users' data.

Casky's platform maps this vulnerability to Resource Development (TA0001) and Exfiltration (TA0043) techniques within its 322 matched security skills. Using Claude AI with extended reasoning, practitioners would see detection patterns identifying SQL injection attempts through anomalous query construction, suspicious parameter encoding, and database error responses indicative of query manipulation. The system would highlight unauthenticated access attempts combined with database schema enumeration (SHOW COLUMNS queries) as a leading indicator of exploitation. Security teams using Casky would detect stacked statements, unusual database operation sequences, and data exfiltration patterns that correlate with post-exploitation activity, enabling rapid identification and containment before attackers achieve persistent data access or theft.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72550.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-72550

Casky has 322 skills that investigate the attack patterns behind CVE-2026-72550. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn