Erupt
Monthly
Authenticated HQL injection in Erupt through version 2.3.0 lets a user who already holds query permission on an entity with a String-keyed linkTree target escape that entity's tree-scoped data filter and read records belonging to other mapped entities. The flaw is reached by posting unescaped quote characters into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, which allows attackers to append always-true OR clauses or boolean subqueries to the generated Hibernate query. Exploitation is not trivial: it depends on valid low-privileged credentials plus a specific data-model configuration (a String-keyed linkTree target with query permission), and the impact is limited to confidentiality - no write or availability effect - so this is best treated as a moderate-priority authorization/data-exposure issue, and no public exploit code has been identified at time of analysis.
SQL injection in Erupt up to version 1.13.3 allows unauthenticated remote attackers to execute arbitrary SQL queries through the sort.field parameter in the HQL query builder. Public exploit code exists for this vulnerability, and no patch is currently available. Affected Java applications using vulnerable versions of Erupt are at risk of data exfiltration and manipulation.
SQL injection in Erupt's MCP Tool Interface allows authenticated attackers to manipulate database queries through the EruptDataQuery component, potentially exposing or modifying sensitive data. The vulnerability affects Java-based Erupt deployments version 1.13.3 and has public exploit code available. No patch is currently available from the vendor, who has not responded to disclosure efforts.
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.
Authenticated HQL injection in Erupt through version 2.3.0 lets a user who already holds query permission on an entity with a String-keyed linkTree target escape that entity's tree-scoped data filter and read records belonging to other mapped entities. The flaw is reached by posting unescaped quote characters into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, which allows attackers to append always-true OR clauses or boolean subqueries to the generated Hibernate query. Exploitation is not trivial: it depends on valid low-privileged credentials plus a specific data-model configuration (a String-keyed linkTree target with query permission), and the impact is limited to confidentiality - no write or availability effect - so this is best treated as a moderate-priority authorization/data-exposure issue, and no public exploit code has been identified at time of analysis.
SQL injection in Erupt up to version 1.13.3 allows unauthenticated remote attackers to execute arbitrary SQL queries through the sort.field parameter in the HQL query builder. Public exploit code exists for this vulnerability, and no patch is currently available. Affected Java applications using vulnerable versions of Erupt are at risk of data exfiltration and manipulation.
SQL injection in Erupt's MCP Tool Interface allows authenticated attackers to manipulate database queries through the EruptDataQuery component, potentially exposing or modifying sensitive data. The vulnerability affects Java-based Erupt deployments version 1.13.3 and has public exploit code available. No patch is currently available from the vendor, who has not responded to disclosure efforts.
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.