CVE-2026-110609: Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit it remotely. No user interaction is required, and exploitation has low complexity.
Which application paths are exposed?
The affected queryErpOrderItem MyBatis statement is reachable through the queryWarehousingDetails and queryOutgoingDetails endpoints. The injection point is the keyword parameter.
What data could an attacker obtain?
An attacker can use boolean-based, UNION-based, error-based, or time-based SQL injection techniques to extract database data. The reported impact includes data belonging to other tenants.
How can teams check whether their deployment is affected?
Review the StatisticsMapper.xml implementation of queryErpOrderItem for raw ${} substitution of the keyword value, and verify whether the queryWarehousingDetails or queryOutgoingDetails endpoints pass attacker-controlled keyword input to that statement.