CVE-2026-111718
HIGH
7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0033
Percentile
0,2th
Updated
EPSS Score Trend (Last 3 Days)
89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Authentication
Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands
Read Application Data
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, SQL
Technologies:
Database Server
https://hackmd.io/@hieuPenguinnn/aipexbase-dynamic-data-order-by-group-by-sql-i…
https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f7104…
https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f7104…
https://hackmd.io/@hieuPenguinnn/aipexbase-dynamic-data-order-by-group-by-sql-i…
https://www.vulncheck.com/advisories/aipexbase-through-commit-690adb9-sql-injec…