pig-mesh pig CVE-2026-115997

Exploitation requires an authenticated request (CVSS PR:L) to an endpoint that uses pig4cloud's SqlFilterArgumentResolver pagination binding, with attacker-controlled ascs or descs sort parameters whose values reach OrderItem.getColumn and flow into an ORDER BY clause. The trigger is an unvalidated sort-column string: pre-patch code relied on com.baomidou.mybatisplus SqlInjectionUtils.check, which the patch's test cases show failed to block expressions such as case/when, hex(), arithmetic (user_id+1), comment sequences (user_id/**/), and backtick-quoted identifiers. Limiting factors: affected versions are pig-mesh pig up to and including 4.1.0 (fixed in 4.1.1); a valid authenticated session is needed; and the vulnerable path only applies to list/query endpoints that actually use this resolver for sorting.

Signals here point consistently toward a low-priority issue despite being a remotely reachable SQL injection. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, driven by PR:L (authentication required) and limited impact (VC:L/VI:L/VA:L, no subsequent-system impact), and the vuln.today decision label is 'monitor' - not act_now or emergency. A public PoC reference exists (vinch3s/pig4cloud-cve) and the description states the exploit has been published, so exploit tooling is available; however, this is a research write-up reference and is not verified as a drop-in working exploit, and there is no CISA KEV listing. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The attack surface is genuinely remote-network but gated behind a valid authenticated session, and the source evidence shows the flaw is an ORDER BY / sort-column injection (ascs/descs parameters reaching OrderItem.getColumn), which typically enables constrained/blind data extraction rather than unrestricted stacked-query compromise. Net: a real, confirmed defect with a vendor patch, but a low-urgency one - authentication plus limited technical impact make it a monitor-and-patch item, not a drop-everything emergency. Missing data to note explicitly: no EPSS, no KEV, and the exact SQL-injection primitive (blind vs. stacked) is not spelled out in the sources.

An authenticated user of a pig4cloud-based application sends a paginated list request and manipulates the ascs or descs sort parameter, injecting a SQL expression (e.g. a CASE/WHEN or function call) that the SqlFilterArgumentResolver passes into the ORDER BY clause. Because the pre-patch SqlInjectionUtils.check filter failed to block such expressions, the crafted sort field is executed, letting the attacker perform blind extraction of data from the backing database. A public PoC reference exists and the description states the exploit has been published, though it is not verified as working exploit code.