CVE-2026-101011
Received Received - Intake

SQL Injection in aaPanel BaoTa Domain Handler

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101011
EUVD
EUVD-2026-88124

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aapanel baota to 11.8.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in aaPanel BaoTa up to version 11.8.0. It exists in the get_domain_status function of the Domain Handler component. The issue arises from improper input validation in the domains parameter, which is used in SQL queries without sanitization. Attackers can manipulate this parameter to inject malicious SQL code, enabling data extraction or unauthorized access.

Detection Guidance

To detect this SQL injection vulnerability in aaPanel BaoTa, you can test the domains parameter using Boolean-based or time-based blind SQL injection techniques. For example, append payloads like 'domains=1 AND 1=1' or 'domains=1 AND 1=2' to API endpoints handling domain status. Observe response differences to confirm vulnerability. Time-based tests like 'domains=1 AND randomblob(300000000)' can also reveal delays indicating SQL injection.

Use tools like curl to send requests: curl -X POST 'http://target.com/get_domain_status?domains=1 AND 1=1' and check for inconsistent responses. Automated scanners like SQLmap may also identify this flaw if the domains parameter is exposed.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary SQL commands. They can extract sensitive data like MySQL root passwords, manipulate database contents, or gain persistent access to the control panel. The exploit is publicly available, increasing the risk of attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). SQL injection risks exposing personal or health data, potentially resulting in regulatory penalties.

Mitigation Strategies

Immediately update aaPanel BaoTa to the latest version if a patch exists. If no patch is available, restrict access to the vulnerable endpoint by blocking external requests to /www/server/panel/mod/project/domain/domainMod.py. Implement input validation to sanitize the domains parameter, rejecting or escaping SQL metacharacters.

Enable Web Application Firewall (WAF) rules to block SQL injection attempts. Monitor logs for suspicious queries involving the domains parameter. Consider disabling the affected functionality temporarily until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart