Description
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A SQL injection flaw exists in the PaginationInnerInterceptor.concatOrderBy method within TDuckCloud's tduck-platform, allowing an attacker to inject arbitrary SQL through the orders[0].column parameter. The flaw can be triggered remotely and could enable the attacker to read, modify, or delete data stored in the database. The vulnerability is classified under CWE-74 and CWE-89 due to improper handling of user‑supplied order clauses.

Affected Systems

Vendors: TDuckCloud; Product: tduck-platform. Versions up to 5.3 are affected. The fix is included in commit ea7f0fae7cb0fd998a3284c11addce689350cd69, which should be applied to any affected deployment.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, while the lack of EPSS data means exploitation probability is not quantified. The vulnerability is not listed in CISA's KEV catalog and no official workaround is provided, so the safest course is to apply the patch or upgrade. A publicly available exploit suggests that an attacker could exploit this flaw with minimal effort over the network.

Generated by OpenCVE AI on September 23, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch commit ea7f0fae7cb0fd998a3284c11addce689350cd69 to the tduck-platform source and redeploy.
  • Upgrade the installation to the latest tduck-platform version that incorporates the fix, ensuring that the effective date of the change is above 5.3.
  • Configure input validation so that only pre‑approved column names are accepted in ORDER BY clauses, or otherwise restrict the API endpoint from receiving unsanitized column names.

Generated by OpenCVE AI on September 23, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue.
Title TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
First Time appeared Tduckcloud
Tduckcloud tduck-platform
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:tduckcloud:tduck-platform:*:*:*:*:*:*:*:*
Vendors & Products Tduckcloud
Tduckcloud tduck-platform
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tduckcloud Tduck-platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-22T23:15:10.573Z

Reserved: 2026-09-22T16:17:27.381Z

Link: CVE-2026-95829

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T00:17:01.333

Modified: 2026-09-23T00:17:01.333

Link: CVE-2026-95829

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T00:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')