{"schema":"threatline.record/2","record":{"id":"CVE-2026-110609","aliases":[],"summary":"Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter","details":"Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.","categories":["Unclassified"],"product":"skyeye","vendor":"dromara","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110609","source_modified_at":"2026-10-14T16:20:46.586Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"skyeye","vendor":"dromara","versions":[{"version":"0","lessThanOrEqual":"65d3ddcede701d33ea5416e47c9b656e47d56401","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00466,"percentile":0.39411,"score_date":"2026-10-23"},"published_at":"2026-10-14T14:16:50.552Z","modified_at":"2026-10-14T16:20:46.586Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110609","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T16:20:46.586Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110609","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/resources/mapper/erp/StatisticsMapper.xml#L29-L31","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/java/com/skyeye/controller/StatisticsController.java#L33-L45","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/dromara/skyeye","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/dromara-skyeye-through-commit-65d3ddcede70-sql-injection-via-keyword-parameter","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T16:20:15.994407Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T16:20:46.586Z","content_hash":"93b6c7920f03fb51ad509f18c5cbb2ceae0e9a03cc82fb14a4cf67c399595580"}}