Yiuman Citrus EUVD-2026-101242

Requires an authenticated low-privilege account (PR:L) on an application built with the Yiuman citrus framework that exposes at least one generic list route from a controller extending BaseQueryController or BaseQueryRestful. The exploitable input is the sortBy request parameter, which is concatenated unvalidated into the SQL ORDER BY clause. Limiting factors: exploitation is impossible without valid authentication and without a deployed generic query endpoint reachable by the attacker; impact is read-only data disclosure via blind inference (slower, order-dependent extraction), not direct record retrieval, modification, or service disruption.

This is a moderate-severity SQL injection (CWE-89) whose signals are internally consistent rather than conflicting. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scores 7.1 and correctly reflects a network-reachable, low-complexity flaw that nonetheless requires PR:L - i.e. an authenticated low-privilege user, not an anonymous attacker. Impact is confined to confidentiality (VC:H, VI:N/VA:N): the ORDER BY injection supports blind boolean-/time-based data extraction but not direct write or denial-of-service. No EPSS score, no CISA KEV listing, and no explicit POC=YES flag were supplied, so there is no evidence of active or at-scale exploitation; the VulnCheck advisory and the linked hackMD write-up describe the technique and vulnerable code (QueryHelper.java L123-129) but do not themselves confirm weaponized exploit code. Net: a genuine but not top-tier priority - the authentication requirement and confidentiality-only impact temper the network attack vector, and the affected product (Yiuman citrus) has a very small real-world footprint, which further lowers practical urgency. Prioritize patching where citrus is deployed and generic query controllers are exposed to semi-trusted users.

An authenticated low-privilege user of an application built on the Yiuman citrus framework sends a request to any generic list endpoint backed by a controller extending BaseQueryController or BaseQueryRestful, placing attacker-controlled SQL in the sortBy parameter that is appended unvalidated to the ORDER BY clause. Because the output is order-dependent rather than directly reflected, the attacker uses boolean- or time-based blind techniques to extract database contents row by row. No public weaponized exploit is confirmed, though the referenced hackMD advisory documents the injection point and method in detail.