CVE-2026-110614: Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
Affected Software
Event History
Frequently Asked Questions
Which endpoints are exposed to this issue?
Any generic list route implemented by a controller that extends BaseQueryController or BaseQueryRestful is affected, because those routes can pass the sortBy request parameter into the generic query framework.
What access does an attacker need?
An attacker needs network access to a reachable affected list route and privileges sufficient to use that route. No user interaction is required.
What can an attacker obtain through exploitation?
The injected ORDER BY expression can be used to extract database contents through boolean-based or time-based blind SQL injection techniques. The provided impact information indicates confidentiality impact without integrity or availability impact.
Are applications using the affected framework version exposed by default?
Exposure depends on whether the application exposes a generic list route through BaseQueryController or BaseQueryRestful to an attacker with the required privileges. The vulnerability is in handling of the sortBy parameter, so routes that do not expose or accept that parameter are not identified as affected by the provided data.