CVE-2026-79573

Published Sep 8, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

Analysis

Technical impact

L-ONE v1.0.0 contains SQL injection flaws in the /attachment/getBusinessUploadList component, allowing attackers to inject crafted SQL via the busid, id, and taskid parameters. This flaw can lead to manipulation of legitimate database queries to expose confidential information, resulting in confidentiality compromise and potential data leakage.

Affected Systems

The affected system is the L-ONE application version 1.0.0. Users who expose the /attachment/getBusinessUploadList endpoint to the network are at risk.

Risk and Exploitability

The CVSS score is 6.5, a medium severity rating, and the EPSS score remains below 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is inferred to be exploitable remotely via HTTP requests to the /attachment/getBusinessUploadList endpoint. There is no indication that this flaw is currently listed in CISA's KEV catalog, and no known public exploit has been reported. Due to the lack of mitigations, the potential for exploitation remains a concern.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor patch or upgrade to a version of L-ONE that fixes the SQL injection in /attachment/getBusinessUploadList
If a patch is not available, temporarily restrict or disable external access to the /attachment/getBusinessUploadList endpoint while a workaround is implemented
Modify the database user privileges so that the application operates with the minimum required permissions, reducing the potential damage of a successful injection

Generated by OpenCVE AI on September 21, 2026 at 05:46 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.365% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/fangtang7/CVE/blob/main/L-ONE/JFinalOA%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md

History

Sep 21, 2026 6:15 AM Title updated View changes

Type	Values Removed	Values Added
Title	SQL Injection in L-ONE /attachment/getBusinessUploadList Allows Sensitive Data Exfiltration

Sep 14, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 5:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		SQL Injection in L-ONE /attachment/getBusinessUploadList Allows Sensitive Data Exfiltration
Weaknesses		CWE-89

Sep 8, 2026 3:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
References		https://github.com/fangtang7/CVE/blob/main/L-ONE/JFinalOA%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md