Description
A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.
Published: 2026-11-09
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the ReportService.queryBiData method of erupt’s ReportService.java. By manipulating the sort parameter, an attacker can inject arbitrary SQL into the underlying query, enabling remote retrieval or modification of database contents. The flaw is a classic SQL injection (CWE-74) and injection of SQL code (CWE-89).

Affected Systems

Erupt’s erupt application, versions up through 2.3.0, is affected. The patch, identified by commit 8d2eaffc79b977c9d11222b9d435a002dceaa062, is shipped in the 2.4.0 release and resolves the issue. The affected product is listed in CPE as erupts:erupt.

Risk and Exploitability

With a CVSS score of 5.3, the vulnerability has moderate severity. EPSS data is not available and it is not listed in the CISA KEV catalog. The exploit can be carried out remotely by supplying a crafted sort argument, and public exploit code is available, meaning a threat actor with network access to the service could readily attempt the injection.

Generated by OpenCVE AI on November 9, 2026 at 01:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade erupt to version 2.4.0 or later to apply the patch 8d2eaffc79b977c9d11222b9d435a002dceaa062
  • If upgrading is not immediately possible, limit the sort parameter to a whitelist of allowable column names to prevent injection
  • Deploy or configure a Web Application Firewall to detect and block SQL injection patterns targeting the ReportService.queryBiData endpoint

Generated by OpenCVE AI on November 9, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 00:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.
Title erupts erupt ReportService.java ReportService.queryBiData sql injection
First Time appeared Erupts
Erupts erupt
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:erupts:erupt:*:*:*:*:*:*:*:*
Vendors & Products Erupts
Erupts erupt
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Erupts Erupt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-09T00:15:31.475Z

Reserved: 2026-11-08T10:48:07.675Z

Link: CVE-2026-124504

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T01:17:02.317

Modified: 2026-11-09T01:17:02.540

Link: CVE-2026-124504

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T01:30:15Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')