CVE-2026-111718: AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack is network-reachable and requires low privileges. No user interaction is required.
Which inputs are vulnerable?
The vulnerable inputs are the order_by and group_by fields accepted by the /api/data/invoke endpoint. These fields can be used to inject SQL, including subqueries or EXTRACTVALUE and UPDATEXML expressions.
What data could be exposed?
An attacker may bypass the SqlGuard denylist and row-level security to read rows and tables belonging to other users. The reported impact is confidentiality loss; integrity and availability impact are not indicated.