CVE-2026-110609
CVE-2026-110609 · Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
CVSS 7.1 · High · EPSS 0.5%
- Published
- Updated
Affected products and versions
skyeye
- Versions
- ≥ 0, ≤ 65d3ddcede701d33ea5416e47c9b656e47d56401: Affected (git)
No fix published
Original sources
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli
- https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/resources/mapper/erp/StatisticsMapper.xml#L29-L31
- https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/java/com/skyeye/controller/StatisticsController.java#L33-L45
- https://github.com/dromara/skyeye
- https://www.vulncheck.com/advisories/dromara-skyeye-through-commit-65d3ddcede70-sql-injection-via-keyword-parameter
- https://nvd.nist.gov/vuln/detail/CVE-2026-110609