CVE-2025-26086: An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler…

PriorityP261high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

11.28%

95.4th percentile

An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler. Attackers can remotely inject time-delayed SQL payloads to induce server response delays, enabling time-based inference and iterative extraction of sensitive database contents without authentication.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
rsiqueue	management_system	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlseclists.org/fulldisclosure/2025/May/21

othertaskid=

commandSLEEP(, pg_sleep(, DELAY , BENCHMARK(

snort

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT RSI Queue Unauthenticated Blind SQL Injection (CVE-2025-26086)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"taskid|3d|"; nocase; fast_pattern; pcre:"/^[^\x26]*?(?:(?:[pP][gG]_)?[sS][lL][eE][eE][pP]\x28|[dD][eE][lL][aA][yY]\x20|[bB][eE][nN][cC][hH][mM][aA][rR][kK]\x28)/R"; reference:url,seclists.org/fulldisclosure/2025/May/21; reference:cve,2025-26086; classtype:web-application-attack; sid:2062512; rev:1; metadata:attack_target Server, created_at 2025_05_22, cve CVE_2025_26086, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Detect inbound HTTP GET requests where the URI contains 'taskid=' (URL-encoded as taskid|3d|) followed by time-based SQL injection functions: SLEEP(), pg_sleep(), DELAY, or BENCHMARK(). The PCRE anchors to the value portion after 'taskid=' and before any '&' delimiter.
→Monitor for anomalous server response delays on the RSI Queue Management System get request handler endpoint, which may indicate time-based blind SQL injection via the TaskID parameter. ↗
→No authentication is required to exploit this vulnerability; alert on any external source triggering the signature, not just authenticated sessions. ↗

·The Snort/Suricata rule (SID 2062512) is tagged for both Perimeter and Internal deployment, meaning it should be applied at network ingress AND on internal segments to catch lateral exploitation attempts.
·The PCRE uses the /R (relative) flag to match the URI content relative to the position after the 'taskid=' match; ensure your IDS/IPS engine supports PCRE relative matching for accurate detection.
·The affected product is specifically RSI Queue Management System v3.0; scope detection rules to hosts running this version to reduce false positives. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.