Citrus
Monthly
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.