Description
A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the getData function of the /www/server/panel/class/data.py file used by aaPanel BaoTa. A crafted value for the log_type parameter can cause the application to construct a malformed SQL query, allowing an attacker to inject arbitrary SQL statements. This flaw does not require authentication and can be triggered remotely, potentially leading to unauthorized data disclosure or database manipulation. The weakness is identified by CWE-74 (Improper Parsing of SQL) and CWE-89 (SQL Injection).

Affected Systems

aaPanel BaoTa versions up to and including 11.8.0 are affected. Users running the default installation of BaoTa from these releases should verify their installation and apply corrective action if an update is not yet available.

Risk and Exploitability

The CVSS score of 5.1 places this flaw in the moderate severity range. EPSS data is unavailable, but the public availability of the exploit suggests a realistic attack window. The vulnerability is not listed in CISA's KEV catalog. Attackers can target the exposed log_type endpoint from a remote host, inject malicious statements, and potentially gain read or write access to the underlying database file.

Generated by OpenCVE AI on September 28, 2026 at 10:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Patch aaPanel BaoTa to version 11.8.1 or later when the vendor releases an update that sanitizes the log_type parameter.
  • Limit external access to the log_type endpoint by configuring firewall rules or restricting web server permissions to trusted IP addresses.
  • Implement input validation for the log_type parameter in the application, ensuring that only permitted values are accepted and properly escaping or using parameterized queries.

Generated by OpenCVE AI on September 28, 2026 at 10:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title aaPanel BaoTa data.py getData sql injection
First Time appeared Aapanel
Aapanel baota
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:aapanel:baota:*:*:*:*:*:*:*:*
Vendors & Products Aapanel
Aapanel baota
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Aapanel Baota
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T11:17:39.929Z

Reserved: 2026-09-27T11:05:16.542Z

Link: CVE-2026-101010

cve-icon Vulnrichment

Updated: 2026-09-28T11:17:35.399Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T08:16:36.807

Modified: 2026-09-28T15:16:04.793

Link: CVE-2026-101010

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T10:45:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')