EUVD-2026-88974
GHSA-2j67-8cw9-qpcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach kykms query/list endpoint
-
DeliveryInject SQL into 'column' sort argument
-
ExploitBypass SqlInjectionUtil filter in doMultiFieldsOrder
-
ExecutionExecute blind SQL inference/tampering
-
ImpactDisclose or modify database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires reaching a kykms list/query endpoint that invokes QueryGenerator.doMultiFieldsOrder with an attacker-controlled 'column' (multi-field ordering) parameter; the injection occurs in the ORDER BY clause, which limits it toward blind/boolean or error-based extraction rather than direct UNION dumping. The supplied vector claims no authentication (PR:N) and no user interaction, but in JeecgBoot-style deployments the sortable data-query endpoints are commonly authenticated, so a valid session may in practice be needed - verify against the specific kykms build. No non-default configuration is cited as required. Affected build is the rolling-release commit up to 8f130c2d85842d5b44caae78cc46d65e505949f7 with no vendor fix available. |
| Impact | This is a network-reachable SQL injection (CWE-89) in the doMultiFieldsOrder function of QueryGenerator.java, part of the SqlInjectionUtil component - a code layout strongly characteristic of JeecgBoot-derived Java/Spring applications, meaning the flaw lives in an ORDER BY / column-sorting parameter that the framework's SQL-injection filter fails to sanitize. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, base 5.5) rates all impacts as Low, consistent with an ORDER BY-position injection where the attacker cannot trivially UNION-extract arbitrary columns but can perform blind/boolean or error-based data inference and limited tampering. Exploitation signal: a public exploit exists (VulDB, GitHub PoC by fangtang7), so this is 'publicly available exploit code exists' - but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation, so PoC availability must not be conflated with in-the-wild use. The vector states PR:N (unauthenticated); however, in JeecgBoot-style products the sortable list endpoints frequently sit behind authentication, so real-world reachability may require a valid session - this should be verified against the actual kykms deployment. Net: a genuine, exploitable SQLi with a working PoC, but tempered by a niche product footprint, modest Low/Low/Low impact rating, and no confirmed exploitation, placing it at moderate rather than urgent priority. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to a kykms list/query endpoint, injecting malicious SQL into the 'column' sort parameter processed by QueryGenerator.doMultiFieldsOrder, which SqlInjectionUtil fails to neutralize. Using boolean/time-based blind techniques, the attacker infers or tampers with database contents. A public exploit write-up is available (github.com/fangtang7/CVE/blob/main/kykms/sql.md), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
SQL injection in mahonelau kykms (rolling release up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7) allows remote attackers to inject arbitrary SQL through the column argument of QueryGenerator.doMultiFieldsOrder, a multi-field ordering routine in the SqlInjectionUtil component. The flaw is CWE-89 improper neutralization of SQL commands and, because the injection lands in an ORDER BY clause, exploitation is typically limited to blind/boolean or error-based extraction rather than direct UNION dumping. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation at time of analysis. The provided CVSS 4.0 vector claims network reachability with no privileges (PR:N) and no user interaction, yet the independent assessment notes that JeecgBoot-style deployments commonly authenticate sortable data-query endpoints, so a valid session may be required in practice - verify against the specific kykms build.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, and the rolling-release model provides no fixed version number. Primary remediation is to treat any deployed kykms build at or below commit 8f130c2d85842d5b44caae78cc46d65e505949f7 as vulnerable and apply an upstream or self-authored fix that replaces string-concatenated ORDER BY construction with a strict server-side allowlist of sortable column names and directions, or with parameterized/prepared query components that cannot accept raw SQL fragments. Until such a fix is deployed, compensating controls should include: requiring authentication (and session validation) on every list/query endpoint that can reach QueryGenerator.doMultiFieldsOrder, since the supplied vector’s PR:N claim is not reliable in typical JeecgBoot-style deployments; blocking or tightly restricting access to those data-query endpoints from untrusted networks via reverse-proxy or WAF rules that reject anomalous multi-field ordering parameters (side effect: legitimate sorting UIs may break or trigger false positives for non-standard column names); and disabling or feature-flagging multi-field ordering entirely where it is not business-critical (side effect: loss of user-facing sort functionality). Monitoring database logs for ORDER BY clauses containing unexpected subqueries, CASE statements, or boolean/comment sequences can provide detection while a patch is pending. Consult https://vuldb.com/vuln/411276 and the public exploit write-up at https://github.com/fangtang7/CVE/blob/main/kykms/sql.md for technical detail when constructing mitigations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is QueryGenerator.java, specifically the doMultiFieldsOrder function, which builds an ORDER BY clause from a caller-supplied column parameter without proper sanitization. The CWE-89 root cause is failure to neutralize special elements in SQL statements; in JeecgBoot-derived Java/Spring applications this pattern is well known, where the framework's SqlInjectionUtil filter is supposed to block dangerous SQL keywords but can be bypassed or simply does not cover multi-field ordering inputs. Hosting is Java-based (per tags), and the CPE cpe:2.3:a:mahonelau:kykms:*:*:*:*:*:*:*:* reflects a continuously delivered product with no fixed version identifiers. Because the injectable point is an ORDER BY expression rather than a WHERE predicate, direct data exfiltration via UNION is less likely; attackers would instead rely on boolean-based blind, time-based blind, or error-based techniques, or attempt to use ORDER BY expression behavior to infer schema and data. No non-default configuration is cited as a prerequisite, but in the real-world JeecgBoot-style deployments these sortable list/query endpoints are frequently protected by authentication, which would raise the practical privilege requirement beyond the PR:N claim in the supplied vector.
Know when Kykms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable ORDER BY injection with the input's PR:N; ORDER BY position limits extraction/tampering to Low across C/I/A rather than full database compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB