java110 MicroCommunity CVE-2026-96803

Requires network reachability to the MicroCommunity fallBack API endpoint (BusinessApi.java → QueryServiceSMOImpl.fallBack) and the ability to control the fallBackSql request argument, which is interpolated into a SQL query. VulDB rates this PR:N (no authentication), so exploitation is claimed against a reachable instance without credentials; however this is not independently confirmed and the endpoint may in practice sit behind application authentication, which would limit real-world exposure. Limiting factors: the product is a niche self-hosted platform, no fixed/patched version exists yet, and exploitation depends on the instance being network-accessible to the attacker.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 6.9) describes a network-reachable, low-complexity SQL injection requiring no privileges or user interaction, with the E:P (Proof-of-Concept) exploit-maturity flag matching the publicly posted Gitee exploit. Signals are mostly consistent - a public POC exists and the attack vector is remote - but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or automated exploitation; this is 'publicly available exploit code exists,' not confirmed in-the-wild abuse. The vendor's own impact rating (VC:L/VI:L/VA:L) is notably conservative for a raw SQL-injection primitive: an endpoint literally named fallBack that consumes an argument called fallBackSql suggests near-direct SQL execution, which typically yields full database read and often write, i.e. C:H/I:H rather than only 'low' impacts - VulDB frequently under-scores impact this way. The main uncertainty is authentication: the description and vendor vector assert PR:N (unauthenticated), but a fallback/query administrative endpoint on a management platform plausibly sits behind a login, which would raise the real-world bar. Net: a genuine, easily-triggered injection with public POC, but confined to a niche product, so priority is moderate and driven by whoever actually exposes MicroCommunity to untrusted networks.

A remote attacker sends a crafted request to the MicroCommunity fallBack API endpoint (BusinessApi.java), placing malicious SQL in the fallBackSql parameter that is concatenated into a database query executed by QueryServiceSMOImpl.fallBack. Because the attack vector is network-based with low complexity, the attacker extracts or manipulates database contents (user records, credentials, community/property data). A public exploit is already available via the Gitee issue tracker, lowering the skill required.