Full Report
WebPros security advisory (AV26-790)
Analysis Summary
# Vulnerability: Blind SQL Injection in WebPros Plesk Obsidian
## CVE Details
- **CVE ID:** CVE-2026-64636
- **CVSS Score:** Not explicitly provided in the summary (Typically High/Critical for SQLi)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
## Affected Systems
- **Products:** Plesk Obsidian
- **Versions:**
- All versions prior to **18.0.80.1**
- All versions prior to **18.0.79.5**
- **Configurations:** Systems running the Plesk control panel web interface.
## Vulnerability Description
CVE-2026-64636 is a blind SQL injection vulnerability. This occurs when an application does not properly sanitize user-supplied input before using it in a database query. In a "blind" scenario, the application does not return actual data from the database to the screen; instead, the attacker must infer data by observing differences in the application's response (such as response times or HTTP status codes) based on Boolean logic queries.
## Exploitation
- **Status:** Not specified (Assume PoC/Exploit could be developed based on the disclosure).
- **Complexity:** Medium (Blind SQLi requires iterative testing/scripting).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential to extract sensitive database information, including administrative credentials or user data).
- **Integrity:** High (Potential to modify or delete database records).
- **Availability:** High (Potential to disrupt services or drop database tables).
## Remediation
### Patches
WebPros has released updates to address this vulnerability. Administrators should upgrade to one of the following versions:
- **Plesk Obsidian 18.0.80.1** or later
- **Plesk Obsidian 18.0.79.5** or later
### Workarounds
No specific manual workarounds have been provided. Immediate patching is the recommended course of action.
## Detection
- **Indicators of Compromise:** Unusual spikes in database activity or web server logs showing repetitive requests with SQL syntax (e.g., `SELECT`, `SLEEP`, `UNION`) in URL parameters or POST bodies.
- **Detection methods:** Web Application Firewalls (WAF) can be configured to detect and block SQL injection patterns. Security teams should perform vulnerability scanning using authenticated tools to verify the patch level of Plesk instances.
## References
- **Vendor Advisory:** hxxps[://]support[.]plesk[.]com/hc/en-us/articles/42431868205079-CVE-2026-64636-Vulnerability-in-Plesk-blind-SQL-injection
- **Canadian Centre for Cyber Security:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/webpros-security-advisory-av26-790