CVE-2022-51023 PHPOK CVE debrief

Who should care

Defenders and administrators of PHPOK installations should assess exposure and apply patches to prevent SQL injection attacks. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

Defenders should prioritize verifying exposure and applying patches for the SQL injection vulnerability in PHPOK versions before 5.4.081, as it can lead to data breaches and other security issues.

• Potential data breaches due to SQL injection
• Need for patch verification and application
• Monitoring for suspicious database queries
• Possible impact on database integrity

Technical summary

The SQL injection vulnerability in PHPOK versions before 5.4.081 allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter in api.php. This can be exploited by sending GET requests with extractvalue payloads in the sort parameter to extract database information through error messages. The vulnerability affects PHPOK installations, and administrators should assess their exposure and apply patches to prevent exploitation. The vulnerability can lead to potential data breaches and other security issues if not addressed promptly.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, as SQL injection attacks can lead to data breaches.

Recommended defensive actions

• Verify PHPOK version and apply patch 5.4.081 or later
• Restrict access to api.php
• Monitor for suspicious database queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in PHPOK versions before 5.4.081. The Shadowserver Foundation first observed exploitation evidence on 2023-10-14. The vulnerability allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter in api.php. This can be exploited by sending GET requests with extractvalue payloads in the sort parameter to extract database information through error messages. The CVE record was published on 2026-10-22T10:57:33.897Z and has not been

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.