SQL Injection in Mjdm Majordomo
CVE-2026-27179
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.006 (48.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.002
Affected products
- Mjdm Majordomo
- Sergejey Majordomo — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- chocapikk.com/posts/2026/majordomo-revisited/ (Exploit, Third Party Advisory, third-party-advisory)
- github.com/sergejey/majordomo/pull/1177 (issue-tracking, Exploit, patch, Issue Tracking)
- www.vulncheck.com/advisories/majordomo-unauthenticated-sql-injection-in-command… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-27179?
- CVE-2026-27179 is a high-severity vulnerability in Mjdm Majordomo, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-02-18.
- How severe is CVE-2026-27179?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2026-27179 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.