CVE-2026-110614
Deferred Deferred - Pending Action

Yiuman Citrus SQL Injection via ORDER BY Clause

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110614
EUVD
EUVD-2026-101242

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Yiuman citrus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110614 is a high-severity SQL injection vulnerability in Yiuman citrus through version 0.15.0. It exists in the citrus-support generic query framework where the sortBy request parameter is used to construct an ORDER BY clause in SQL queries without proper validation. Attackers can inject malicious SQL code via this parameter to manipulate database queries and extract contents using blind techniques like boolean-based or time-based methods.

Detection Guidance

To detect this SQL injection vulnerability, monitor HTTP requests to endpoints using BaseQueryController or BaseQueryRestful for unsanitized sortBy parameters. Look for unusual ORDER BY clauses in logs or database queries. Use tools like SQLMap to test for blind SQL injection via time-based or boolean-based techniques on the sortBy parameter.

Impact Analysis

This vulnerability allows attackers to access sensitive database contents by injecting SQL commands through the sortBy parameter. It can lead to data breaches, unauthorized data extraction, or manipulation of database records. Systems using affected versions of Yiuman citrus may be compromised if the vulnerable controllers are exposed to user input.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or breaches. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful SQL injection could result in unauthorized data exposure, violating these regulations and potentially leading to legal penalties or loss of certification.

Mitigation Strategies

Immediately upgrade citrus to a version beyond 0.15.0 if available. If not, implement strict input validation for the sortBy parameter by creating an allowlist of permitted column names and rejecting all others. Sanitize inputs or use parameterized queries to prevent SQL injection in ORDER BY clauses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart