---
id: "CVE-2026-124504"
page: "https://infrastack.ai/live/CVE-2026-124504"
kind: "vulnerability"
aliases: ["CVE-2026-124504"]
title: "erupt: SQL injection via the sort argument in report queries"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erupt", "java", "package", "self-hosted"]
not_affected_if: ["erupt-2.4.0-or-later"]
published_at: "2026-11-09T01:17:02+00:00"
first_seen_at: "2026-11-09T01:23:57+00:00"
updated_at: "2026-11-09T01:25:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124504", "first_seen_at": "2026-11-09T01:23:57+00:00"}]
exploit_sources: []
---

# erupt: SQL injection via the sort argument in report queries

Link for people: https://infrastack.ai/live/CVE-2026-124504 (this .md is for agents)

The erupt Java admin framework lets a remote user inject SQL through the sort argument of ReportService.queryBiData in versions up to 2.3.0. An attacker who can send requests to the application can read or alter database data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the erupt version in the project's pom.xml or build.gradle for `2.3.0` or lower
- Look for ReportService.queryBiData in the ReportService.java file and whether the sort parameter reaches SQL unparameterized

## Fix

- erupt: upgrade to `2.4.0`

## Timeline

- 2026-11-09T01:23:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124504

## Documents

- [fix] Patch: github.com https://github.com/erupts/erupt/commit/8d2eaffc79b977c9d11222b9d435a002dceaa062
- [fix] Release notes: github.com https://github.com/erupts/erupt/releases/tag/2.4.0

## From the sources

A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_