CVE-2026-102491: mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs the ability to remotely supply a manipulated value for the column argument processed by QueryGenerator.doMultiFieldsOrder. No privileges or user interaction are required according to the provided severity vector.
Which deployments should be treated as potentially affected?
Deployments of mahonelau kykms containing code up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7 should be treated as potentially affected. Because the product uses a rolling release model, no affected or fixed release versions are provided.
Is exploit code available?
Yes. The exploit is publicly available, so defenders should assume the issue may be actively attempted.
How can I determine whether my code is exposed?
Review the SqlInjectionUtil component for QueryGenerator.java and determine whether QueryGenerator.doMultiFieldsOrder accepts or incorporates an externally controllable column argument. Code derived from or matching the affected commit range should be investigated.