EUVD-2026-89953
GHSA-px8c-rh7j-hvgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed SOPLOG instance
-
DeliverySend crafted request with SQL payload
-
ExploitInjection breaks out of SQL command
-
ExecutionDatabase executes attacker query
-
ImpactExfiltrate or tamper with database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to a SOPLOG instance running a version before 2026.9.4.1; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is needed against a default deployment. The primary limiting factor is exposure and prevalence rather than technical prerequisites: SOPLOG is a niche product, so realistic risk is confined to the specific organizations that deploy it, and instances behind a VPN, WAF, or not internet-facing substantially reduce reachability. The exact vulnerable input (parameter/endpoint) is not disclosed, so defenders cannot yet scope a precise detection or virtual-patch signature. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes a maximally severe flaw: a remote, unauthenticated, low-complexity SQL injection with total confidentiality, integrity, and availability impact. However, the raw score should be weighed against real-world signals, most of which are absent here. There is no EPSS probability, no CISA KEV listing, and no public POC referenced - so there is no evidence of active or imminent exploitation, only high theoretical severity. No SSVC data was provided. The dominant risk-limiting factor is prevalence: SOPLOG is a niche product from a Turkish vendor (Dolusoft Software Technologies), disclosed solely through TR-CERT, so the attack surface across the global internet is small even though any exposed instance would be trivially attackable. This is best treated as a genuinely dangerous flaw for the specific organizations running SOPLOG (patch urgently), but not a broad-ecosystem emergency comparable to a critical flaw in ubiquitous software. Note that no vulnerable parameter, endpoint, or injection sink is specified in the sparse description - the CVSS metrics are taken from the vendor/TR-CERT advisory and cannot be independently corroborated from the provided data. |
| Exploit ScenarioDerived | A remote attacker, without any credentials, sends a crafted HTTP request containing a malicious SQL payload to an internet-exposed SOPLOG instance running a version before 2026.9.4.1. Because user input is not properly neutralized in an SQL command, the payload executes against the backend database, letting the attacker read, alter, or destroy stored data. No public exploit code is identified at time of analysis, but the trivial complexity (AC:L, PR:N) means a working exploit could be developed quickly from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated SQL injection in Dolusoft SOPLOG affects every release before 2026.9.4.1, allowing a remote attacker who can reach a SOPLOG instance to inject arbitrary SQL into the application's backend queries, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N combined with high confidentiality, integrity, and availability impact producing a 9.8 Critical score. Because the vector carries PR:N and UI:N, no credentials, user interaction, or special configuration are required against a default deployment, so the practical limiting factor is exposure and prevalence rather than technical prerequisites - realistic risk is confined to organizations that actually run SOPLOG, and VPN-only, WAF-fronted, or non-internet-facing instances are substantially harder to reach. No public exploit identified at time of analysis, and the specific vulnerable parameter or endpoint has not been disclosed, which currently prevents defenders from scoping a precise detection or virtual-patch signature.
RemediationAI
The primary fix is to upgrade SOPLOG to version 2026.9.4.1 or later, the boundary of the stated affected range "before Soplog 2026.9.4.1," and to confirm the exact patched build with the vendor and the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1224, since no independent patch-verification data was supplied. Where upgrading cannot be completed promptly, the most effective compensating control is reducing reachability: place the SOPLOG instance behind a VPN or an allow-listed reverse proxy and block direct inbound access from the internet, accepting that this also removes legitimate external access for remote users and integrations. A WAF with generic SQL-injection rule sets can add friction, but trade-offs are real: because the vulnerable parameter and endpoint are not disclosed, signature tuning is guesswork and false positives on legitimate query strings are likely, so a WAF should be treated as a stopgap rather than a fix. Additionally, constrain the blast radius by running the SOPLOG database connection under a least-privilege account with no DDL, file-system, or stacked-query capability, and monitor database and application logs for anomalous or unusually structured SQL, noting that this detects exploitation rather than preventing it. The durable code-level remedy is parameterized queries or prepared statements for every input-derived value; until that is verified in the fixed release, treat any pre-2026.9.4.1 instance as compromised-capable and audit for unauthorized data access or modification.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-89, improper neutralization of special elements used in an SQL command, meaning application-supplied input is concatenated or otherwise passed into a SQL statement without adequate escaping or parameterization, letting an attacker restructure the query itself. The affected component is SOPLOG, a product of Dolusoft Software Technologies, and the CPE cpe:2.3:a:dolusoft_software_technologies:soplog:*:*:*:*:*:*:*:* uses a version wildcard, reflecting that the vendor advisory covers all builds prior to 2026.9.4.1 rather than a narrow release window. The network-only attack path (AV:N) with low complexity (AC:L) and no privileges (PR:N) is consistent with a directly reachable web application or web service interface where injected SQL is executed under the application's database account; in that position an attacker may read arbitrary tables, tamper with or delete records, and in many database engines escalate to file read/write or command execution depending on the backend privileges and enabled features. The bulletin originates from Turkey's national CERT (TR-CERT, advisory TR-26-1224), a detail that suggests the affected deployment base is concentrated in that region, but the underlying defect class is platform-agnostic SQL injection. No CVE-level detail on the vulnerable parameter, HTTP method, or database engine has been published, so the exploit surface cannot yet be narrowed beyond "a SOPLOG endpoint that builds SQL from user input."
Know when Soplog gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Advisory describes remote unauthenticated SQL injection with no user interaction; SQLi typically yields full read/write/delete over the database, so C:H/I:H/A:H.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.
This issue affects SOPLOG: before Soplog 2026.9.4.1.
Executive ViewAI
Dolusoft SOPLOG, a third-party logistics/operations platform used in supply-chain and warehouse environments, carries a critical unauthenticated SQL injection affecting every release before 2026.9.4.1, meaning any internet-reachable instance can be compromised by an attacker with no credentials and no user interaction. Because no vendor fix exists yet, any organization running SOPLOG on an externally accessible host should treat the underlying database as potentially reachable by unauthorized parties, with exposure limited only by how many instances are published to the internet. Leadership should care because successful exploitation would place the full contents of the SOPLOG backend database - operational records, customer and partner data, and credentials - under attacker control, with potential integrity loss and service outage across dependent business processes.
No vendor-released patch identified at time of analysis. Interim mitigations: remove all internet exposure of SOPLOG instances and restrict access to VPN or trusted internal networks only; front remaining reachable instances with a WAF enforcing SQL-injection rules on all inbound traffic; segment the SOPLOG backend database so it is reachable only from the application tier; enforce least-privilege database accounts and rotate those credentials; increase logging and monitoring of SOPLOG database queries and outbound data volume for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB