CVE-2026-9524
BaseFortify
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xianrendzw | easyreport | to 2.0.17.0522_Beta (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-9524 vulnerability involves a SQL injection flaw that can lead to unauthorized manipulation and potential exposure of sensitive data stored or processed by the EasyReport application.
Such vulnerabilities can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Failure to remediate this vulnerability could result in data breaches, leading to violations of data protection requirements, potential legal penalties, and loss of trust.
Can you explain this vulnerability to me?
CVE-2026-9524 is a stored SQL injection vulnerability found in the EasyReport project. It occurs when report parameters are accepted via a REST API and stored in a database using MyBatis. Later, these parameters are retrieved and concatenated directly into SQL queries without proper parameterization, allowing malicious SQL code to be executed.
The vulnerability arises because the application uses MyBatis `${}` syntax or Java string concatenation to build SQL queries instead of using parameterized queries. This improper handling of input leads to the possibility of SQL injection attacks.
Authentication is required to manage reports, but once authenticated, an attacker can manipulate the 'reportParams' argument to inject SQL commands remotely.
The vulnerability is classified under CWE-89 (SQL Injection) and has a high severity with a CVSS score of 7.5.
How can this vulnerability impact me? :
This SQL injection vulnerability can allow an attacker to execute arbitrary SQL commands on the database used by EasyReport. This can lead to unauthorized data access, data modification, or deletion.
Potential impacts include data breaches, loss of data integrity, disruption of service, and exposure of sensitive information stored in the database.
Since the attack can be launched remotely after authentication, it increases the risk of exploitation by insiders or compromised accounts.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves SQL injection through the manipulation of the reportParams argument in the REST API of EasyReport. Detection can focus on monitoring and analyzing REST API requests that interact with report parameters, especially those that might include SQL injection payloads.
Since authentication is required for report management, detection can include reviewing logs for suspicious or malformed reportParams inputs that attempt SQL injection patterns.
Specific commands are not provided in the resources, but general approaches include using web application firewalls (WAF) to detect SQL injection attempts, and employing tools like sqlmap to test the REST endpoint by sending crafted payloads to the reportParams parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Ensure that the application uses parameterized queries by replacing MyBatis `${}` syntax or Java string concatenation with `#{}` syntax to prevent SQL injection.
- Validate and sanitize all input values, especially the reportParams argument, to remove or escape special characters that could be used in injection attacks.
- Restrict access to the REST API endpoints to authenticated and authorized users only.
- Monitor logs for suspicious activity and consider deploying a web application firewall (WAF) to block SQL injection attempts.