EUVD-2026-66816
GHSA-w6x9-86mp-c7cf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote SQL injection over HTTP into an unparameterized query yields total read/write/destroy database impact, so AV:N/AC:L/PR:N/UI:N with C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.
AnalysisAI
SQL injection in super-diamond-server (versions <= 1.3.3) lets remote attackers manipulate backend database queries via the front-end preview endpoint /superdiamond/preview/{projectCode}/{module}/{type}. The module path parameter is split with StringUtils.split() and concatenated directly into a SQL IN clause without parameterization, giving unauthenticated attackers (per CVSS PR:N) a path to read, alter, or destroy configuration data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reachable HTTP access to the super-diamond-server front-end preview endpoint /superdiamond/preview/{projectCode}/{module}/{type} on a vulnerable instance (<= 1.3.3), with the injection carried in the {module} path parameter that flows through StringUtils.split() into an unparameterized SQL IN clause. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw signals are largely aligned toward high severity: CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a remote, low-complexity, unauthenticated attack with total impact, and SSVC corroborates this with Exploitation=poc, Automatable=yes, and Technical Impact=total. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Super Diamond front-end sends a crafted HTTP GET to /superdiamond/preview/{projectCode}/{module}/{type} with SQL payload embedded in the module segment, causing injected syntax to execute inside the IN clause. Using UNION-based or boolean/time-based techniques they extract stored configuration secrets or modify/delete records; a public write-up demonstrating the injection already exists, and the low attack complexity makes the technique easily automatable. |
| Remediation | No vendor-released patch version was identified in the provided data, so a specific fixed release cannot be cited; monitor the upstream super-diamond project and the referenced advisories (VulDB https://vuldb.com/vuln/396032 and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-75330) for a patched release above 1.3.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all instances of super-diamond-server version 1.3.3 or earlier and immediately restrict network access to the /superdiamond/preview/ endpoint using firewall rules or web application firewall (WAF) policies, blocking all external traffic and permitting access only from trusted internal networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today