tduck-platform CVE-2026-95829

Requires an authenticated session (PR:L) on the TDuck tduck-platform (≤5.3) and access to a paginated listing endpoint that flows into MyBatis-Plus pagination sorting (e.g., user/form-template/theme queries). The attacker must supply the orders[0].column sort parameter, which is concatenated into the ORDER BY clause by PaginationInnerInterceptor.concatOrderBy without allowlisting - this identifier position cannot be parameterized by JDBC, which is why the fix adds SqlInjectionUtils.check and an alphanumeric/underscore/dot regex allowlist. Limiting factors: valid credentials are required (not remote-unauthenticated), and impact is primarily inferential data disclosure typical of order-by injection rather than arbitrary data modification.

The vendor/VulDB CVSS 4.0 base score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and uniformly Low impacts (VC:L/VI:L/VA:L), and E:P confirms proof-of-concept maturity. This is an authenticated (PR:L) SQL injection in the MyBatis-Plus pagination order-by handling (PaginationInnerInterceptor.concatOrderBy) reached via the attacker-controlled orders[0].column parameter - a column-identifier injection, which MyBatis/JDBC cannot bind as a parameter, so it is a genuine injection class. However, order-by column injection is materially narrower than classic value-based injection: it typically enables boolean/blind and error/time-based inference (confidentiality-leaning) rather than full data modification or dumping, which is consistent with the Low integrity/availability ratings. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation despite the public PoC. The description's 'exploit is publicly available and might be used' aligns with E:P but does not equal active exploitation - treat as PoC-available, not weaponized in the wild. Net priority: moderate-and-conditional. It requires an authenticated account (PR:L) on a niche open-source form/survey platform, which sharply limits real-world blast radius; patch promptly if TDuck is internet-exposed with low-trust user accounts, otherwise routine remediation is adequate.

An authenticated low-privilege user of a TDuck form platform submits a paginated list request (e.g., user/template/theme listing) and manipulates the orders[0].column sort parameter, injecting SQL into the ORDER BY clause that MyBatis-Plus cannot parameterize. Because a public exploit exists, the attacker uses boolean/error/time-based inference to extract data from the backing database. Exploitation is remote over HTTP but gated on holding a valid account.