Dromara Skyeye EUVD-2026-101237

Exploitation requires a valid authenticated account with at least low privileges (CVSS PR:L) and network access to the Skyeye application's ERP statistics functionality. The specific attack surface is the 'keyword' request parameter processed by the queryWarehousingDetails or queryOutgoingDetails endpoints, which flows into the queryErpOrderItem MyBatis statement using unsafe raw ${} string substitution instead of parameterized #{} binding. No user interaction is needed and no special non-default configuration is called out in the description - the ERP module simply needs to be deployed and reachable. The principal limiting factor is the authentication requirement; the principal aggravating factor is that cross-tenant data is exposed, so a single low-privilege tenant account can reach other tenants' data.

This is a genuine but moderate-priority issue rather than an exaggerated high-CVSS finding. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) is internally consistent with the description: a network-reachable SQL injection reachable by any authenticated low-privileged user, with high confidentiality impact (data extraction, including cross-tenant data) and no integrity or availability impact. The PR:L requirement is the primary risk limiter - an attacker must already hold valid low-privilege credentials, so this is not an unauthenticated pre-auth RCE-class flaw. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified here. No public exploit identified at time of analysis, though a detailed technical write-up (hackmd) and a VulnCheck advisory with exact vulnerable source locations exist, which materially lowers the bar for an attacker to reproduce the injection. Net: real and worth patching, especially for multi-tenant deployments where cross-tenant data leakage is possible, but the mandatory authentication and the niche deployment footprint keep broad, automated mass-exploitation unlikely.

An attacker with any valid low-privilege Skyeye account sends a crafted 'keyword' value to the queryWarehousingDetails or queryOutgoingDetails endpoint, where the input is concatenated into the queryErpOrderItem MyBatis statement via raw ${} substitution. Using boolean, UNION, error, or time-based techniques, they exfiltrate arbitrary database contents - including records belonging to other tenants. No public exploit is identified, but a public technical write-up and a VulnCheck advisory pinpoint the exact vulnerable mapper and controller lines.