Description
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-23
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the strip_data function of search.php in the Search Module of SoftNews Media Group DataLife Engine 18.0. By manipulating the story argument, an attacker can inject arbitrary SQL statements. This allows the attacker to read, modify, or delete database records, which could lead to data loss, unauthorized disclosure, or further compromise of the site.

Affected Systems

SoftNews Media Group DataLife Engine version 18.0. This version uses the Search Module containing the vulnerable strip_data function.

Risk and Exploitability

The CVSS base score of 6.9 indicates a moderate severity, but the remote attack vector and publicly available exploit raise the risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, attackers can trigger the injection from an external host and potentially gain unauthorized database access.

Generated by OpenCVE AI on September 23, 2026 at 23:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade DataLife Engine to the latest patched release that resolves the strip_data SQL injection.
  • If an immediate upgrade is not possible, block or restrict access to the search.php endpoint using a web application firewall or network rules to reduce attack surface.
  • Disable the Search Module or remove the vulnerable strip_data functionality from the deployed installation until a fix is applied.

Generated by OpenCVE AI on September 23, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title SoftNews Media Group DataLife Engine Search search.php strip_data sql injection
First Time appeared Softnews Media Group
Softnews Media Group datalife Engine
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:softnews_media_group:datalife_engine:*:*:*:*:*:*:*:*
Vendors & Products Softnews Media Group
Softnews Media Group datalife Engine
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Softnews Media Group Datalife Engine
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-23T22:00:07.142Z

Reserved: 2026-09-23T13:54:49.774Z

Link: CVE-2026-96604

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T22:17:00.297

Modified: 2026-09-23T22:17:00.297

Link: CVE-2026-96604

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:30:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')