CVE-2021-47872 SEO Panel < 4.9.0 - 'order_col' Blind SQL Injection
Authenticated attackers can exploit a blind SQL injection in SEO Panel to extract database information via the order_col parameter.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47872?
CVE-2021-47872 is a high-severity SQL injection vulnerability in SEO Panel, published on 21 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate database queries through the 'order_col' parameter. Attackers can use sqlmap to exploit the vulnerability and extract database information by injecting malicious SQL code into the order column parameter.
Weakness: CWE-89
Which versions are affected by CVE-2021-47872?
How do I fix CVE-2021-47872?
No fix has been published for CVE-2021-47872 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-47872 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47872 exists.
Sources
Also known as GHSA-v74m-68w4-83qm.