EUVD-2026-101242
GHSA-5pf4-h875-jgfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitReach generic list route (BaseQueryController/Restful)
-
ExecutionInject SQL via sortBy into ORDER BY
-
ImpactBlind boolean/time-based extraction of database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on an application built with the Yiuman citrus framework that exposes at least one generic list route from a controller extending BaseQueryController or BaseQueryRestful. The exploitable input is the sortBy request parameter, which is concatenated unvalidated into the SQL ORDER BY clause. Limiting factors: exploitation is impossible without valid authentication and without a deployed generic query endpoint reachable by the attacker; impact is read-only data disclosure via blind inference (slower, order-dependent extraction), not direct record retrieval, modification, or service disruption. |
| Impact | This is a moderate-severity SQL injection (CWE-89) whose signals are internally consistent rather than conflicting. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scores 7.1 and correctly reflects a network-reachable, low-complexity flaw that nonetheless requires PR:L - i.e. an authenticated low-privilege user, not an anonymous attacker. Impact is confined to confidentiality (VC:H, VI:N/VA:N): the ORDER BY injection supports blind boolean-/time-based data extraction but not direct write or denial-of-service. No EPSS score, no CISA KEV listing, and no explicit POC=YES flag were supplied, so there is no evidence of active or at-scale exploitation; the VulnCheck advisory and the linked hackMD write-up describe the technique and vulnerable code (QueryHelper.java L123-129) but do not themselves confirm weaponized exploit code. Net: a genuine but not top-tier priority - the authentication requirement and confidentiality-only impact temper the network attack vector, and the affected product (Yiuman citrus) has a very small real-world footprint, which further lowers practical urgency. Prioritize patching where citrus is deployed and generic query controllers are exposed to semi-trusted users. |
| Exploit ScenarioDerived | An authenticated low-privilege user of an application built on the Yiuman citrus framework sends a request to any generic list endpoint backed by a controller extending BaseQueryController or BaseQueryRestful, placing attacker-controlled SQL in the sortBy parameter that is appended unvalidated to the ORDER BY clause. Because the output is order-dependent rather than directly reflected, the attacker uses boolean- or time-based blind techniques to extract database contents row by row. No public weaponized exploit is confirmed, though the referenced hackMD advisory documents the injection point and method in detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.
RemediationAI
No vendor-released patch identified at time of analysis; the advisory data lists version 0.15.0 as the last vulnerable release without naming a fixed version, so organizations should watch the upstream project at https://github.com/Yiuman/citrus and the VulnCheck advisory at https://www.vulncheck.com/advisories/yiuman-citrus-through-0.15.0-order-by-sql-injection-via-sortby-parameter for a corrected build, and upgrade citrus-support (and rebuild downstream applications) as soon as one is tagged. Because standard JDBC placeholders cannot bind ORDER BY identifiers, the realistic code-level fix is to stop concatenating sortBy and instead map the parameter through a strict allowlist of known entity property names, rejecting anything that does not match a fixed whitelist or a regex such as ^[A-Za-z0-9_]+$ and then resolving it to a trusted column via the ORM's criteria/metamodel API. As compensating controls until a patch is available: restrict access to generic list endpoints (BaseQueryController/BaseQueryRestful routes) to the smallest set of trusted roles, since the issue requires an authenticated low-privilege account, and disable or wrap those endpoints where they are not business-critical; run the application's datasource with least-privilege, read-only credentials on a schema that excludes sensitive tables, which limits the confidentiality impact but does not fix the injection; and deploy WAF or gateway rules that reject sortBy values containing SQL metacharacters, comments, or SLEEP/BENCHMARK/WAITFOR patterns, accepting that keyword filtering is bypassable and may cause false positives on legitimate multi-column sorts. Detection should focus on anomalous query latency and repeated identical list requests with varying sortBy parameters, which are the signature of time-based blind extraction in this injection path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection caused by unsafe string concatenation in citrus-support's generic query framework. Per the referenced source, QueryHelper.java (lines 123-129 in the 0.15.0 tag) builds the ORDER BY clause of generated SQL by concatenating the caller-supplied sortBy value without validation, allowlisting, or parameterization. Because ORDER BY column names and directions cannot be bound through standard JDBC PreparedStatement placeholders in the general case, this code path is a common weak spot in Java ORM/query-helper designs, and the framework's design amplifies the blast radius: any controller that extends BaseQueryController or BaseQueryRestful automatically exposes generic list routes that feed user input into this helper. The affected component is the Maven-style artifact path citrus-support under the upstream project com.github.yiuman/citrus, tracked by the CPE cpe:2.3:a:yiuman:citrus:*:*:*:*:*:*:*:* for all releases through 0.15.0. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the exploitation profile: network-reachable, low complexity, requiring a low-privilege authenticated session, with a confidentiality-only impact. The injected payload terminates or extends the ORDER BY clause, so boolean-based (differential result ordering) and time-based (SLEEP/benchmark-style delays) blind techniques are the practical extraction methods; error-based or UNION-based retrieval is constrained by the position of the injection point, making extraction slow and order-dependent but still capable of full database read-out within the same privileges as the application's datasource.
Know when Citrus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable, low-complexity injection requiring a low-privilege authenticated account (PR:L); blind data extraction yields C:H with no integrity or availability impact and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
Executive ViewAI
The Yiuman Citrus Java framework (versions through 0.15.0) contains a SQL injection vulnerability that could allow low-privilege users to extract sensitive database information from applications built on the framework. This read-only disclosure risk affects any organization using the framework with exposed generic query endpoints, potentially leading to data breaches and regulatory compliance issues. Leadership should prioritize mitigation because the vulnerability requires only valid credentials and is externally exploitable.
Interim mitigations include restricting access to generic query endpoints, implementing input validation via whitelisting of sortBy column names, deploying WAF SQL injection rules, and monitoring database queries for anomalies. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB