CVE-2026-102491

Executive Summary

CVE-2026-102491 is an unpatched SQL injection vulnerability in the open-source project mahonelau kykms, specifically within the function QueryGenerator.doMultiFieldsOrder in the file QueryGenerator.java, part of the SqlInjectionUtil component. A remote, unauthenticated attacker can manipulate the column argument to inject arbitrary SQL, resulting in unauthorized data disclosure, modification, and partial availability impact. The exploit is publicly available, and no vendor fix exists, leaving all deployments on the rolling-release branch vulnerable.

Technical Analysis

The vulnerability resides in the QueryGenerator.doMultiFieldsOrder method of QueryGenerator.java, which belongs to the SqlInjectionUtil component of the kykms project. According to the NVD description, the impacted element is the column argument. When this argument is passed to QueryGenerator.doMultiFieldsOrder, it is incorporated into a SQL query without adequate sanitization or parameterization, allowing an attacker to alter the query's structure. This is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) leading to SQL injection.

The vulnerable component, SqlInjectionUtil, suggests the project attempted to centralize SQL injection prevention. The fact that the flaw exists in a method named doMultiFieldsOrder implies the function dynamically constructs an ORDER BY clause from multiple user-supplied column names — a common pattern where developers resort to string concatenation because prepared statements do not natively support parameterizing column identifiers. This makes the column argument a direct injection point.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms:

• Network exploitable (AV:N) with low complexity (AC:L)
• No privileges required (PR:N) and no user interaction (UI:N)
• Unchanged scope (S:U)
• Partial confidentiality, integrity, and availability impact (C:L/I:L/A:L)

No public proof-of-concept code, Nuclei template, or exploit code is confirmed in the provided data, but the NVD description explicitly states the exploit is publicly available. The attack surface is any exposed HTTP endpoint that routes user input into QueryGenerator.doMultiFieldsOrder's column parameter — typically sorting or column-selection functionality in a web UI or REST API.

Because this is a rolling-release product, no affected version ranges are defined; any deployment tracking the project up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7 (and likely later commits, absent a fix) is presumed vulnerable.

Exploitation Scenarios

1) Reconnaissance / Target Identification An attacker identifies a kykms instance by fingerprinting HTTP responses for application-specific strings (e.g., "kykms") or by scanning for exposed admin/API endpoints. No authentication is needed, so the endpoint is reachable directly.

2) Triggering the Flaw The attacker sends an HTTP request that supplies a malicious value to the column argument that is ultimately consumed by QueryGenerator.doMultiFieldsOrder. Because the function builds part of a SQL statement from this argument, the attacker can break out of the intended query context and inject SQL syntax. No specific HTTP endpoint or parameter name is disclosed in the NVD description; the injection point is the column argument as passed into the identified function.

3) Payload / Execution The injection class is ORDER BY-style or multi-field ordering injection. At the vulnerability-class level, typical payloads include boolean-based or error-based constructs (e.g., appending , (SELECT ...) or subquery expressions) to force the database to evaluate attacker-controlled SQL. Because ORDER BY clauses are often not parameterizable, common techniques include conditional CASE expressions or stacked subqueries to exfiltrate data. No public PoC details are available; the attack chain is inferred from the vulnerability class.

4) Post-Exploitation Impact Successful exploitation yields unauthorized read and potentially modify access to the underlying database, consistent with the partial C/I/A impact (C:L/I:L/A:L). An attacker could extract credentials, configuration, or business data, and depending on database privileges, alter or delete records. The unauthenticated, network-reachable nature makes it exploitable at scale against internet-facing instances.

Impact Assessment

Business impact includes data breach exposure (partial confidentiality loss), data tampering (partial integrity loss), and possible service degradation (partial availability loss). The blast radius is every kykms instance exposed to untrusted networks — including internet-facing deployments and internal instances reachable by compromised users. With no vendor patch, no versioned upgrade path, and no workaround supplied, organizations running this project face sustained risk. The EPSS score is not yet assigned by FIRST.org, so no probabilistic exploitation forecast is available. CVSS base score 7.3 (High) reflects network-exploitable, low-complexity, unauthenticated access. This CVE is not currently in CISA KEV, but the public exploit availability raises the likelihood of opportunistic scanning and exploitation.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against kykms QueryGenerator doMultiFieldsOrder
id: 4b8f2c1e-9d3a-4f7b-8e2c-1a6f0d9c3b7e
status: experimental
description: Detects HTTP requests containing SQL meta-characters in parameters likely routed to QueryGenerator.doMultiFieldsOrder (column argument) in mahonelau kykms.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102491
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_keywords:
    cs-uri-query|contains:
      - 'column='
      - 'orderBy='
      - 'order='
      - 'sort='
  selection_sqli:
    cs-uri-query|contains:
      - 'select '
      - 'union '
      - 'sleep('
      - 'benchmark('
      - "case when"
      - '--'
      - '/*'
      - ' or 1=1'
      - ' and 1=1'
  condition: selection_method and selection_keywords and selection_sqli
falsepositives:
  - Legitimate application sorting parameters containing SQL keywords (rare)
level: high

YARA Rule

rule CVE_2026_102491_kykms_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting kykms QueryGenerator.doMultiFieldsOrder column argument"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102491"
        date = "2026-01-01"
        severity = "high"
    strings:
        $fn = "doMultiFieldsOrder" ascii wide nocase
        $cls = "QueryGenerator" ascii wide nocase
        $util = "SqlInjectionUtil" ascii wide nocase
        $sqli1 = "union select" ascii wide nocase
        $sqli2 = "sleep(" ascii wide nocase
        $sqli3 = "benchmark(" ascii wide nocase
        $sqli4 = "case when" ascii wide nocase
        $sqli5 = " or 1=1" ascii wide nocase
    condition:
        (any of ($fn, $cls, $util)) and any of ($sqli1, $sqli2, $sqli3, $sqli4, $sqli5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102491 kykms SQL Injection Attempt in QueryGenerator.doMultiFieldsOrder"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"column"; nocase; http.uri; pcre:"/(union[\s\+]+select|sleep\(|benchmark\(|case[\s\+]+when|or[\s\+]+1=1|--|\/\*)/i"; reference:cve,CVE-2026-102491; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-102491; classtype:web-application-attack; sid:2026102491; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.method in ("GET","POST") and
     wildcard(http.request.uri.query, "*column=*")]
  [http where http.request.method in ("GET","POST") and
     (wildcard(http.request.uri.query, "*union select*") or
      wildcard(http.request.uri.query, "*sleep(*") or
      wildcard(http.request.uri.query, "*benchmark(*") or
      wildcard(http.request.uri.query, "*case when*") or
      wildcard(http.request.uri.query, "*or 1=1*"))]

Splunk SPL Query

index=web_logs (sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=apache:access)
| eval uri_lower = lower(uri)
| where (match(uri_lower, "column=") OR match(uri_lower, "orderby=") OR match(uri_lower, "sort="))
| where (match(uri_lower, "union\+select") OR match(uri_lower, "sleep\(") OR match(uri_lower, "benchmark\(") OR match(uri_lower, "case\+when") OR match(uri_lower, "or\+1=1") OR match(uri_lower, "--"))
| stats count values(uri) as uris by src_ip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,kykms,">
  <rule id="1024910" level="12">
    <if_sid>31100</if_sid>
    <id>^GET|^POST</id>
    <url>column=</url>
    <regex type="pcre2">(?i)(union[\s\+]+select|sleep\(|benchmark\(|case[\s\+]+when|or[\s\+]+1=1|--)</regex>
    <description>CVE-2026-102491: kykms SQL injection attempt in QueryGenerator.doMultiFieldsOrder column argument</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Deploy a web application firewall (WAF) with virtual patching rules to block SQL metacharacters in sorting/column parameters (the column argument reaching QueryGenerator.doMultiFieldsOrder).
• Restrict network exposure: do not expose kykms instances directly to the internet; place behind VPN or zero-trust proxy.
• Apply input allow-listing at the reverse proxy for column/order parameters — permit only known-safe column names.
• Monitor HTTP logs for SQL keyword patterns as defined in the detection rules above.

2) Patch / upgrade steps

• No official patch exists. Contact the vendor (mahonelau) through project channels and track the repository for a security commit. Since the vendor did not respond to the initial disclosure, treat the project as abandoned until a fix appears.
• If using a fork, refactor QueryGenerator.doMultiFieldsOrder to validate the column argument against a strict allow-list of permitted column identifiers rather than string concatenation. Avoid interpolating user input into SQL fragments even when parameterization is not directly supported.
• Pin to a known commit only if independently audited; the rolling-release model provides no versioned safe baseline.

3) Long-term hardening

• Enforce least-privilege database accounts for the application to limit impact of injection (reduce C/I/A blast radius).
• Adopt secure coding standards mandating parameterized queries and allow-list validation for dynamic identifiers (ORDER BY columns).
• Implement continuous dependency and code review for rolling-release software; avoid unmaintained projects in internet-facing roles.
• Enable comprehensive logging and EDR on database and application hosts.

References

1. NVD — CVE-2026-102491: https://nvd.nist.gov/vuln/detail/CVE-2026-102491
2. CWE-74 — Improper Neutralization of Special Elements: https://cwe.mitre.org/data/definitions/74.html
3. mahonelau kykms project repository (vendor source; no advisory issued): search project host for "mahonelau kykms"
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA KEV Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No confirmed threat actor campaigns or exploit-in-the-wild evidence are available beyond the NVD statement that the exploit is publicly available and might be used.