Executive Summary

CVE-2026-5147 is a security vulnerability in the yudao-cloud project version v2026.01 involving SQL injection attacks. Specifically, it affects the /admin-api/system/tenant/get-by-website endpoint, where an attacker can manipulate the 'website' parameter to perform a SQL Boolean Blind Injection without needing to authenticate.

This means an attacker can send specially crafted requests that alter the SQL queries executed by the backend database, potentially allowing them to extract sensitive information or manipulate the database.

Additionally, there is a related SQL Blind Injection vulnerability in the /admin-api/system/mail-log/page endpoint, which requires authentication but can be exploited due to weak default credentials (admin/admin123). This allows time-based blind SQL injection attacks to extract data by measuring response delays.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive database information, data leakage, and potential compromise of the backend database.

Because the injection can be performed remotely and without authentication on one endpoint, attackers can exploit it easily to gather information or manipulate data.

The presence of weak default credentials on another endpoint further increases the risk, allowing attackers to perform time-based blind SQL injection attacks to extract data.

Overall, exploitation could lead to data breaches, loss of data integrity, and disruption of service.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability can be detected by testing the affected endpoints for SQL injection using crafted requests that manipulate the 'website' parameter or other vulnerable parameters.

• For the unauthenticated SQL Boolean Blind Injection in `/admin-api/system/tenant/get-by-website`, you can send a request like: `/admin-api/system/tenant/get-by-website?website=8.138.89.15:8888'%27AND(IF(06339=6338,1,(select table_name from information_schema.tables)))AND'%27Z` and observe the response behavior.
• Use sqlmap, a popular SQL injection tool, to automate detection of the injection vulnerability on this endpoint.
• For the authenticated SQL Blind Injection in `/admin-api/system/mail-log/page`, after logging in with default credentials (`admin/admin123`), send a request like: `GET /admin-api/system/mail-log/page?pageNo=1&pageSize=10&toMail='and(select*from(select+sleep(10))a/**/union/**/select+1)=' HTTP/1.1` and measure if the response is delayed by 10 seconds, indicating a time-based blind SQL injection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoints, especially the unauthenticated ones, and changing or disabling weak default credentials such as 'admin/admin123' to prevent authenticated exploitation.

Additionally, monitor and block suspicious requests that attempt SQL injection payloads targeting the affected APIs.

Applying input validation and parameterized queries in the application code to prevent SQL injection is critical, though this may require vendor patches or code updates.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-5147 vulnerability allows attackers to perform SQL injection attacks on the yudao-cloud system, potentially leading to unauthorized access to sensitive data stored in the backend database.

Such unauthorized data access and potential data breaches can result in non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information against unauthorized access and disclosure.

Therefore, exploitation of this vulnerability could lead to violations of these standards due to compromised confidentiality, integrity, and availability of protected data.

Useful 0 Not Useful 0