SQL injection in AipexBase via /api/data/invoke
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
AipexBase through commit 690adb9 is affected. Its /api/data/invoke endpoint does not properly neutralize SQL in the order_by and group_by fields, which is an SQL injection flaw (CWE-89). A remote attacker with low privileges can supply subqueries or EXTRACTVALUE and UPDATEXML functions to bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for AipexBase.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111718
- 2026-10-16 Alias added: GHSA-hcjf-66qr-8j38
- 2026-10-18 CISA SSVC decision points changed
References
Other 2
- https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/OrderByBuilder.java#L24-L67
- https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/GroupByBuilder.java#L22-L33
Sources
- CVE-2026-111718 · CVE Program
- CVE-2026-111718 · NVD
- FIRST EPSS
- GHSA-hcjf-66qr-8j38 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences