{"id":"CVE-2026-124504","kind":"vulnerability","aliases":["CVE-2026-124504"],"related":[],"title":"erupt: SQL injection via the sort argument in report queries","description":"A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.","summary":"The erupt Java admin framework lets a remote user inject SQL through the sort argument of ReportService.queryBiData in versions up to 2.3.0. An attacker who can send requests to the application can read or alter database data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erupt","java","package","self-hosted"],"not_affected_if":["erupt-2.4.0-or-later"],"how_to_check":"- Check the erupt version in the project's pom.xml or build.gradle for `2.3.0` or lower\n- Look for ReportService.queryBiData in the ReportService.java file and whether the sort parameter reaches SQL unparameterized","fix":"- erupt: upgrade to `2.4.0`","status":"open","published_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","triaged_at":"2026-11-09T01:25:32+00:00","updated_at":"2026-11-09T01:25:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T01:25:32Z","model":"claude-haiku-5-5","output":{"fix":"- erupt: upgrade to `2.4.0`","reach":"internet","title":"erupt: SQL injection via the sort argument in report queries","impact":"high","summary":"The erupt Java admin framework lets a remote user inject SQL through the sort argument of ReportService.queryBiData in versions up to 2.3.0. An attacker who can send requests to the application can read or alter database data.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","erupt","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or changes database contents through injected SQL","analyst_note":"Confirm whether the sort-parameter endpoint requires login and what the fix commit 8d2eaffc79b977c9d11222b9d435a002dceaa062 changed, from the linked patch page.","how_to_check":"- Check the erupt version in the project's pom.xml or build.gradle for `2.3.0` or lower\n- Look for ReportService.queryBiData in the ReportService.java file and whether the sort parameter reaches SQL unparameterized","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["erupt-2.4.0-or-later"],"who_is_affected":"Teams running erupt up to 2.3.0 that expose the BI report query endpoint. The sources describe a remote attack through the sort argument, so reachable deployments are the exposed ones; teams on 2.4.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4637,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124504':13A,16A '-2026':12A,15A '2.3.0':44B,69C '2.4.0':114C '8d2eaffc79b977c9d11222b9d435a002dceaa062':123C 'admin':26B 'affect':70C,130C 'alter':57B 'applic':53B 'argument':7A,37B,87C 'attack':46B,94C 'carri':99C 'compon':131C 'cve':11A,14A 'data':59B 'databas':58B 'detect':63C 'erupt':1A,17B,24B,65C,66C 'exploit':103C 'file':80C 'framework':27B 'function':76C 'host':22B 'inject':3A,32B,92C 'issu':73C,118C 'java':18B,25B 'let':28B 'manipul':84C 'may':108C 'name':122C 'packag':19B 'patch':120C 'perform':82C 'possibl':96C 'public':106C 'queri':10A 'read':55B 'remot':30B,101C 'report':9A 'reportservice.java':81C 'reportservice.querybidata':39B,77C 'request':50B 'resolv':116C 'result':89C 'self':21B 'self-host':20B 'send':49B 'sort':6A,36B,88C 'sql':2A,33B,91C 'suggest':126C 'upgrad':111C,128C 'use':110C 'user':31B 'version':41B,113C 'via':4A 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Teams running erupt up to 2.3.0 that expose the BI report query endpoint. The sources describe a remote attack through the sort argument, so reachable deployments are the exposed ones; teams on 2.4.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erupt","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124504':13A,16A '-2026':12A,15A 'argument':7A 'cve':11A,14A 'erupt':1A 'inject':3A 'queri':10A 'report':9A 'sort':6A 'sql':2A 'via':4A","search_b":"'2.3.0':44B 'admin':26B 'alter':57B 'applic':53B 'argument':37B 'attack':46B 'data':59B 'databas':58B 'erupt':17B,24B 'framework':27B 'host':22B 'inject':32B 'java':18B,25B 'let':28B 'packag':19B 'read':55B 'remot':30B 'reportservice.querybidata':39B 'request':50B 'self':21B 'self-host':20B 'send':49B 'sort':36B 'sql':33B 'user':31B 'version':41B","search_c":"'2.3.0':69C '2.4.0':114C '8d2eaffc79b977c9d11222b9d435a002dceaa062':123C 'affect':70C,130C 'argument':87C 'attack':94C 'carri':99C 'compon':131C 'detect':63C 'erupt':65C,66C 'exploit':103C 'file':80C 'function':76C 'inject':92C 'issu':73C,118C 'manipul':84C 'may':108C 'name':122C 'patch':120C 'perform':82C 'possibl':96C 'public':106C 'remot':101C 'reportservice.java':81C 'reportservice.querybidata':77C 'resolv':116C 'result':89C 'sort':88C 'sql':91C 'suggest':126C 'upgrad':111C,128C 'use':110C 'version':113C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T01:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124504","severity":null,"published_at":"2026-11-09T01:17:02+00:00","modified_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","fetched_at":"2026-11-09T01:23:57+00:00","note":null}],"documents":[{"id":104939,"url":"https://github.com/erupts/erupt/commit/8d2eaffc79b977c9d11222b9d435a002dceaa062","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":104941,"url":"https://github.com/erupts/erupt/releases/tag/2.4.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}