YunaiV yudao-cloud EUVD-2026-26813

Authentication is required - the attacker must possess valid credentials to access the yudao-cloud application and specifically the GoView reporting module (PR:L in CVSS vector indicates 'low privileges' rather than 'no privileges'). Network accessibility is required to reach the application endpoint (AV:N). The vulnerable getDataBySQL function must be called, which occurs when a user interacts with the reporting data retrieval feature. No special configuration is required beyond normal deployment; the vulnerability is present in default installations. The primary limiting factor is the authentication requirement - unauthenticated remote exploitation is not possible. Secondary limiting factors include database permission levels: if the application database user has restricted permissions, the scope of damage is reduced.

The CVSS 6.3 score reflects a network-accessible vulnerability requiring low privileges (PR:L) with low complexity exploitation (AC:L), yielding low impact to confidentiality, integrity, and availability (C:L/I:L/A:L). The exploit probability is marked as Probable (E:P) with reasonable confidence (RC:R), indicating the vulnerability is straightforward to exploit but not trivial. The presence of publicly available exploit code significantly elevates real-world risk beyond the base CVSS score. However, the authentication requirement (PR:L) limits attack surface to authenticated users or accounts with valid credentials - this is a critical limiting factor that reduces risk for organizations with strong access controls on the reporting module. The lack of vendor response to disclosure and the nature of SQL injection in a data service function suggest this could be exploited by insiders or attackers who have compromised user credentials. The reporting/analytics component context suggests this may be used in business intelligence workflows, increasing data exposure severity. Real-world priority should be elevated if the reporting service is exposed to untrusted users or if credential compromise is plausible in the threat model.

An authenticated user with access to the GoView reporting module submits a crafted SQL query containing injection payload via the getDataBySQL function - for example, appending a UNION-based injection or stacked queries to exfiltrate sensitive data or modify database records. The vulnerable function concatenates the user input directly into the SQL command without parameterization, allowing the injected SQL to execute with the application's database credentials. Within seconds, an attacker gains unauthorized access to sensitive data or the ability to modify or delete records, depending on database permissions.