Erupt Framework CVE-2026-124504

Requires an authenticated low-privilege session (PR:L) on the erupt application and the ability to reach the BI/report data-query feature that invokes ReportService.queryBiData; the specific prerequisite is supplying attacker-controlled input in the 'sort' argument, which is injected into SQL. Exploitation is remote over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The limiting factor is the authentication requirement - an attacker must first obtain valid (even low-privilege) credentials or an account - and reachability of the reporting feature; only erupt versions up to and including 2.3.0 are affected, with 2.4.0 fixed.

This is a CWE-89 SQL injection in the erupt low-code framework (ReportService.queryBiData, via the 'sort' argument) affecting versions up to 2.3.0. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base 5.3, E:P) describes a network-reachable, low-complexity flaw that requires some authentication (PR:L) and yields only Low confidentiality/integrity/availability impact to the vulnerable system, with no scope change. The vendor description states a public exploit exists, and E:P (Proof-of-Concept) in the vector is consistent with that, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active, widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a moderate-severity, patch-available issue rather than a top-priority emergency. The main signals are consistent: moderate CVSS, authenticated access needed, PoC available but no confirmed in-the-wild exploitation - making this a real but routine-priority fix. One caveat: the rated impact is only Low across C/I/A, which is conservative for a SQL injection class that can often read or alter arbitrary database contents; the actual blast radius may be larger than the Low ratings imply, so treat the impact rating as the vendor/VulDB assessment rather than an independently confirmed ceiling. EPSS is missing, so probabilistic exploitation likelihood could not be weighed.

An attacker with a low-privilege authenticated account on an erupt-based application reaches the BI reporting function and supplies a crafted 'sort' value to ReportService.queryBiData, which is concatenated into a SQL query. The injection lets them alter the query to read or manipulate database records beyond their intended access. A public proof-of-concept is reported by VulDB, and the low attack complexity (AC:L) means exploitation requires no special timing or conditions once authenticated.