An unauthenticated SQL injection in the element search endpoint allows execution of a stacked query, enabling escalation to administrator privileges.

A maliciously crafted search string that flows through the code path:

Search::normalizeSearchQuery() SearchQuery::_parse() Search::_sqlWhere()

Can result in a SQL injection attack.

• SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.
• Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash.