CVE-2026-110614
Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 14, 2026
Description
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
citrusYiuman |
|
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqlithird-party-advisory
- https://github.com/Yiuman/citrus/blob/0.15.0/citrus-support/src/main/java/com/github/yiuman/citrus/support/crud/query/QueryHelper.java#L123-L129technical-description
- https://github.com/Yiuman/citrusproduct
- VulnCheck Advisory: Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.