CVE-2026-110609

Executive Summary

CVE-2026-110609 is an SQL injection vulnerability in Dromara Skyeye (through commit 65d3ddcede70) that allows authenticated low-privileged users to inject arbitrary SQL through the keyword parameter handled by the queryErpOrderItem MyBatis statement. Because the statement performs raw ${} string substitution rather than parameterized binding, crafted keyword values submitted to the queryWarehousingDetails or queryOutgoingDetails endpoints permit extraction of database contents, including data belonging to other tenants. CVSS 3.1 scores this 6.5 (Medium) with High confidentiality impact and no public PoC, exploit code, or Nuclei template currently available.

Technical Analysis

The root cause is CWE-89 (SQL Injection) realized through unsafe string interpolation inside a MyBatis mapper. MyBatis distinguishes between two substitution mechanisms: #{}, which produces a JDBC prepared-statement parameter placeholder and safely escapes the supplied value, and ${}, which performs literal text substitution of the value directly into the generated SQL string before it is sent to the database. When ${} is used, attacker-controlled input becomes part of the SQL grammar itself and is not escaped or type-bound, so any SQL the database will parse can be injected.

In this case the vulnerable statement is queryErpOrderItem, and the injection point is the keyword parameter. The statement is exposed through at least two reachable endpoints — queryWarehousingDetails and queryOutgoingDetails — meaning the injection is reachable over the network by any caller who can invoke those operations. The advisory states that the issue is exploitable by authenticated users holding only low privileges, so the attack surface is the set of authenticated sessions that can reach the warehousing and outgoing detail query functionality.

The NVD description explicitly enumerates the exploitation techniques that apply: boolean-based, UNION-based, error-based, and time-based SQL injection. This indicates the parameter is used in a position where the result set and error behavior are controllable enough to support both data-returning (UNION) and inference-based (boolean/time) extraction, and that database error messages may be surfaced. The description further states that extracted data can include other tenants' data, which indicates the application is deployed in a multi-tenant configuration and that the vulnerable query executes against a database in which tenant isolation is enforced at the application layer rather than being carried through the injected query itself. Consequently a successful injection can read across tenant boundaries.

Notable constraints: the issue is only exploitable by authenticated users (PR:L, not PR:N), which reduces the exposed population, and the CVSS subscores indicate no integrity or availability impact (I:N, A:N) — the described effect is read-based information disclosure (C:H). No specific database product, table name, or column name is given in the description; those details are not available at the time of writing.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-110609. The attack chain below is therefore described at the vulnerability-class level and strictly follows the details present in the NVD description; no implementation specifics beyond the named parameter, statement, and endpoints are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Dromara Skyeye deployment and obtains a valid, low-privileged authenticated account. Because the flaw requires authentication, credential acquisition (through any separate means, e.g., default, shared, or provisioned low-privilege accounts) is a prerequisite step in the chain.

2. Triggering the flaw class. With an authenticated session, the attacker reaches one of the affected endpoints — queryWarehousingDetails or queryOutgoingDetails — and supplies a crafted value in the keyword parameter. That value flows into the queryErpOrderItem MyBatis statement, where it is spliced in with raw ${} substitution instead of the parameterized #{} binding. The substitution converts attacker text into executable SQL, which the database parses and executes in the context of the application's database connection.

3. Payload / execution (class level). Because ${} insertion provides no escaping, standard SQL injection techniques described in the advisory apply: boolean-based inference (true/false conditions to reveal data bit by bit), UNION-based extraction (appending an additional SELECT to return attacker-selected columns), error-based extraction (forcing the database to emit data within error messages), and time-based inference (delays conditioned on injected predicates where no other signal is observable). The attacker iterates payloads through the keyword parameter to characterize the query structure, then extracts query results from the underlying data store.

4. Post-exploitation impact. Successful exploitation yields read access to database content returned by or inferred through the injected query, and the advisory states this includes other tenants' data. Impact is limited to confidentiality in the CVSS assessment (C:H, I:N, A:N): no modification or deletion of data and no service disruption are described. The practical consequence in a multi-tenant deployment is cross-tenant data exposure.

Impact Assessment

Business impact centers on confidentiality. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a base score of 6.5 (Medium). The vector indicates: remotely exploitable over the network (AV:N); no special conditions required beyond authentication (AC:L); a requirement for low privileges and an authenticated session (PR:L); no user interaction (UI:N); a scope that does not change beyond the vulnerable component (S:U); High confidentiality impact (C:H); and no integrity or availability impact (I:N, A:N).

Affected systems are Dromara Skyeye deployments through commit 65d3ddcede70. In multi-tenant environments, the blast radius extends across tenant boundaries because the description states that extracted data can include other tenants' data — meaning a low-privileged tenant account could expose records belonging to unrelated tenants. Because exploitation depends on an authenticated low-privilege account rather than unauthenticated access, the exposed population is bounded by the number of valid sessions (e.g., provisioned users, integration accounts) that can reach the queryWarehousingDetails or queryOutgoingDetails endpoints. No integrity or availability effects are described, so the primary consequence is exfiltration of stored data and the associated privacy, regulatory, and contractual exposure arising from cross-tenant disclosure.

Detection Guidance

Sigma Rule

title: Dromara Skyeye SQL Injection via Keyword Parameter (CVE-2026-110609)
id: 8f4e6f61-3f0a-4a3d-8f2e-9c1b7d7a6c11
status: experimental
description: Detects SQL injection attempts against Skyeye queryErpOrderItem via the keyword parameter on queryWarehousingDetails or queryOutgoingDetails endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110609
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'queryWarehousingDetails'
      - 'queryOutgoingDetails'
  selection_keyword:
    cs-uri-query|contains:
      - 'keyword='
  selection_sqli:
    cs-uri-query|contains:
      - ' UNION '
      - "' OR '"
      - '" OR "'
      - ' OR 1=1'
      - ' OR 1=2'
      - "' AND '"
      - 'SLEEP('
      - 'BENCHMARK('
      - 'WAITFOR DELAY'
      - '-- '
      - '/*'
      - 'EXTRACTVALUE('
      - 'UPDATEXML('
  condition: selection_endpoint and selection_keyword and selection_sqli
falsepositives:
  - Legitimate keyword values containing substrings such as 'OR'
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.110609

YARA Rule

rule CVE_2026_110609_Skyeye_SQLi_Keyword
{
    meta:
        description = "Detects SQL injection patterns targeting Dromara Skyeye keyword parameter (CVE-2026-110609)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110609"
        cve = "CVE-2026-110609"

    strings:
        $ep1 = "queryWarehousingDetails" ascii wide nocase
        $ep2 = "queryOutgoingDetails" ascii wide nocase
        $stmt = "queryErpOrderItem" ascii wide nocase
        $kw = "keyword" ascii wide nocase

        $sqli_union = "UNION SELECT" ascii wide nocase
        $sqli_or1   = "OR 1=1" ascii wide nocase
        $sqli_or2   = "OR 1=2" ascii wide nocase
        $sqli_sleep = "SLEEP(" ascii wide nocase
        $sqli_bench = "BENCHMARK(" ascii wide nocase
        $sqli_wait  = "WAITFOR DELAY" ascii wide nocase
        $sqli_err1  = "EXTRACTVALUE(" ascii wide nocase
        $sqli_err2  = "UPDATEXML(" ascii wide nocase
        $sqli_cmt1  = "-- " ascii wide
        $sqli_cmt2  = "/*" ascii wide

    condition:
        (uint16(0) == 0x3c3f or uint16(0) == 0x7b22 or true) and
        (
            ($ep1 or $ep2) and $kw and any of ($sqli_*)
        )
        or
        ($stmt and $kw and any of ($sqli_*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110609 Dromara Skyeye SQL Injection via keyword parameter (queryWarehousingDetails/queryOutgoingDetails)"; flow:to_server,established; http.uri; content:"queryWarehousingDetails"|20|"queryOutgoingDetails"; content:"keyword"; nocase; pcre:"/(?:union[\s\S]{1,10}select|or\s+1\s*=\s*1|or\s+1\s*=\s*2|sleep\s*\(|benchmark\s*\(|waitfor\s+delay|extractvalue\s*\(|updatexml\s*\()/Ui"; reference:cve,2026-110609; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110609; classtype:web-application-attack; sid:2026110609; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [
    network where
      http.request.method == "POST" or http.request.method == "GET" and
      (
        http.request.uri.query : ("queryWarehousingDetails" or "queryOutgoingDetails") or
        url.path : ("queryWarehousingDetails" or "queryOutgoingDetails")
      ) and
      http.request.uri.query : "keyword"
  ]
  [
    network where
      http.request.uri.query : "keyword" and
      (
        http.request.uri.query : (
          "*UNION SELECT*", "*OR 1=1*", "*OR 1=2*",
          "*SLEEP(*", "*BENCHMARK(*", "*WAITFOR DELAY*",
          "*EXTRACTVALUE(*", "*UPDATEXML(*"
        )
      )
  ]

Splunk SPL Query

index=web sourcetype=access_combined
(
  uri_path IN ("*queryWarehousingDetails*", "*queryOutgoingDetails*")
  OR uri_query="*queryWarehousingDetails*"
  OR uri_query="*queryOutgoingDetails*"
)
uri_query="*keyword*"
(uri_query="*UNION*SELECT*"
 OR uri_query="*OR+1%3D1*" OR uri_query="*OR 1=1*"
 OR uri_query="*OR+1%3D2*" OR uri_query="*OR 1=2*"
 OR uri_query="*SLEEP(*" OR uri_query="*BENCHMARK(*"
 OR uri_query="*WAITFOR+DELAY*" OR uri_query="*EXTRACTVALUE(*"
 OR uri_query="*UPDATEXML(*")
| rex field=uri_query "keyword=(?<keyword_val>[^&]+)"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(keyword_val) as payloads
        by src_ip, uri_path, dest
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,">
  <rule id="2026109" level="12">
    <if_sid>31100,31101,31103,31104,31106</if_sid>
    <url>queryWarehousingDetails|queryOutgoingDetails</url>
    <regex>keyword=.*(\bUNION\b.*\bSELECT\b|\bOR\b\s*1\s*=\s*1|\bOR\b\s*1\s*=\s*2|SLEEP\s*\(|BENCHMARK\s*\(|WAITFOR\s+DELAY|EXTRACTVALUE\s*\(|UPDATEXML\s*\()</regex>
    <description>CVE-2026-110609: Dromara Skyeye SQL injection attempt via keyword parameter on queryWarehousingDetails/queryOutgoingDetails</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version list, or OSV package data is available from the tracked sources at the time of writing.

1. Immediate mitigations:

   • Restrict network exposure of the queryWarehousingDetails and queryOutgoingDetails endpoints (and the Skyeye instance generally) to trusted networks or require access through a hardened reverse proxy, rather than leaving them reachable broadly.
   • Enforce least privilege on Skyeye accounts: audit, reduce, or disable low-privileged accounts that can reach these endpoints, and rotate credentials for any such accounts, since exploitation requires only low-privileged authenticated access.
   • Deploy the Sigma, Suricata, Elastic, Splunk, and Wazuh detections above in monitoring-only mode first, then alerting, to identify active injection attempts against the keyword parameter.
   • If the source is available for the deployment, remediate the root cause by replacing the raw ${} substitution in the queryErpOrderItem MyBatis statement with parameterized #{} binding or strict allow-listing of the keyword value, and rebuild/redeploy. This is the definitive fix for the CWE-89 root cause.
   • Validate or sanitize the keyword parameter at the application boundary (input validation/allow-listing), understanding this is a defense-in-depth control and not a substitute for parameterization.

2. Patch/upgrade steps:

   • No patch reference or fixed version is currently available. Check the Dromara Skyeye project's official repository and release channels for a commit or release that removes the unsafe ${} substitution in queryErpOrderItem; until such a fix is published and verified, treat the deployment as unpatched.
   • If Skyeye is built from source at a pinned commit, do not remain on commit 65d3ddcede70; track upstream for the remediating change and rebuild from a corrected revision once available.

3. Long-term hardening:

   • Institute a code review/gating rule that prohibits raw ${} substitution in MyBatis statements for any user-influenced value; require #{} parameter binding by default.
   • Enforce tenant isolation at the database layer (row-level security or tenant-scoped queries) so that even a successful injection cannot cross tenant boundaries.
   • Run the application's database account with least privilege (read-only where possible for query paths) to limit what an injected statement can reach.
   • Adopt SAST/dependency scanning that flags interpolation-based SQL construction, and include SQL injection test cases for all query endpoints in CI.

References

• NVD — CVE-2026-110609: https://nvd.nist.gov/vuln/detail/CVE-2026-110609
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Dromara Skyeye project repository (track for remediating commit/release): https://github.com/dromara/skyeye
• FIRST EPSS — CVE-2026-110609 (not yet scored; check for updates): https://api.first.org/data/v1/epss?cve=CVE-2026-110609
• CISA Known Exploited Vulnerabilities Catalog (no KEV entry as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or evidence of in-the-wild exploitation or threat-actor campaign is associated with CVE-2026-110609 at the time of writing.