CVE-2026-110609
CVE-2026-110609 · Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
CVSS 7.1 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
skyeye
- Versiones
- ≥ 0, ≤ 65d3ddcede701d33ea5416e47c9b656e47d56401: Afectada (git)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli
- https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/resources/mapper/erp/StatisticsMapper.xml#L29-L31
- https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/java/com/skyeye/controller/StatisticsController.java#L33-L45
- https://github.com/dromara/skyeye
- https://www.vulncheck.com/advisories/dromara-skyeye-through-commit-65d3ddcede70-sql-injection-via-keyword-parameter
- https://nvd.nist.gov/vuln/detail/CVE-2026-110609