{"id":"CVE-2026-81815","kind":"vulnerability","aliases":["CVE-2026-81815"],"related":[],"title":"Apache OFBiz: SQL injection lets unauthenticated users read arbitrary database rows","description":"SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _ic=Y) with a crafted value, causing SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter, which is insufficient on MySQL/MariaDB because those dialects also honor backslash escapes, letting a backslash-terminated payload break out of the string literal and turn the WHERE clause into a tautology. The default Derby datasource and PostgreSQL are not affected because they do not interpret backslash as an escape character in this context. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 on MySQL or MariaDB has an SQL injection in its generic find service when an ignore-case find request is sent. A remote unauthenticated attacker can read arbitrary rows from the queried entity.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","mariadb","mysql","package"],"not_affected_if":["derby-datasource","patched-24.09.08","postgresql-datasource"],"how_to_check":"- Confirm the OFBiz version in use is `24.09.x` and below `24.09.08`\n- Check the configured entity datasource is MySQL or MariaDB rather than Derby or PostgreSQL (the sources say Derby and PostgreSQL are not affected)","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:50+00:00","updated_at":"2026-11-05T15:40:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T15:40:50Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: SQL injection lets unauthenticated users read arbitrary database rows","impact":"medium","summary":"Apache OFBiz 24.09 before 24.09.08 on MySQL or MariaDB has an SQL injection in its generic find service when an ignore-case find request is sent. A remote unauthenticated attacker can read arbitrary rows from the queried entity.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","mysql","mariadb","java"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads arbitrary rows from any queried database entity","analyst_note":"Confirm the affected version range and whether the ignore-case find path is reachable unauthenticated in default configurations via the NVD entry.","how_to_check":"- Confirm the OFBiz version in use is `24.09.x` and below `24.09.08`\n- Check the configured entity datasource is MySQL or MariaDB rather than Derby or PostgreSQL (the sources say Derby and PostgreSQL are not affected)","plain_action":"","needs_analyst":true,"not_affected_if":["derby-datasource","postgresql-datasource","patched-24.09.08"],"who_is_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 that use a MySQL or MariaDB datasource are exposed to unauthenticated requests reaching the generic performFind service with an ignore-case find parameter such as _ic=Y. The sources say the default Derby datasource and PostgreSQL are not affected. Teams on other OFBiz versions or on Derby or PostgreSQL can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000774,"input_tokens":4446,"output_tokens":659,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-81815':14A,17A '24.09':27B,77C '24.09.08':29B,79C,201C 'affect':180C 'allow':83C 'also':148C 'ansi':127C 'ansi-on':126C 'apach':1A,19B,25B,75C 'apache-ofbiz':18B 'arbitrari':9A,58B,90C 'attack':55B,87C 'backslash':150C,155C,186C 'backslash-termin':154C 'bind':135C 'break':158C 'case':47B,101C 'caus':111C 'charact':190C 'claus':168C 'context':193C 'craft':109C 'cve':12A,15A 'databas':10A 'datasourc':175C 'default':173C 'deploy':82C 'derbi':174C 'dialect':147C 'direct':120C 'disclos':89C 'doubl':132C 'e.g':104C 'engin':69C 'entiti':63B,68C,95C 'entityfunct':117C 'entityfunction-wrap':116C 'escap':151C,189C 'find':41B,48B,102C 'fix':203C 'generic':40B,71C 'honor':149C 'ic':105C 'ignor':46B,100C 'ignore-cas':45B,99C 'inject':4A,37B,65C 'inlin':114C 'instead':133C 'insuffici':142C 'interpret':185C 'issu':205C 'java':21B 'let':5A,152C 'liter':163C 'mariadb':22B,33B 'mysql':23B,31B 'mysql/mariadb':144C 'mysql/mariadb-backed':81C 'ofbiz':2A,20B,26B,76C 'packag':24B 'paramet':139C 'payload':157C 'performfind':72C 'postgresql':177C 'queri':62B,94C 'quot':131C 'read':8A,57B 'recommend':196C 'remot':53B,85C 'request':49B,103C 'row':11A,59B,91C 'sent':51B 'servic':42B,73C 'singl':130C 'single-quot':129C 'sql':3A,36B,64C,123C 'sqljdbcutil.addvaluesingle':112C 'string':162C 'submit':97C 'tautolog':171C 'termin':156C 'text':124C 'turn':165C 'unauthent':6A,54B,86C 'upgrad':198C 'use':125C 'user':7A,194C 'valu':110C,119C 'version':200C 'wrap':118C 'y':106C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 that use a MySQL or MariaDB datasource are exposed to unauthenticated requests reaching the generic performFind service with an ignore-case find parameter such as _ic=Y. The sources say the default Derby datasource and PostgreSQL are not affected. Teams on other OFBiz versions or on Derby or PostgreSQL can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","java","mariadb","mysql","package","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81815","severity":null,"published_at":"2026-11-05T15:17:26+00:00","modified_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}