CVE-2026-124504: erupts erupt ReportService.java ReportService.queryBiData sql injection
A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erupts eruptto a version that resolves this vulnerability.Fixed in 2.4.0Patch 8d2eaffc79b977c9d11222b9d435a002dceaa062
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires low privileges. No user interaction is required.
Which deployments are affected?
Erupt versions up to and including 2.3.0 are affected. The issue is in ReportService.queryBiData, where manipulation of the sort argument can lead to SQL injection.
Is exploit activity a practical concern?
Yes. A public exploit is available, so attackers may be able to use it without developing their own exploit.
What is the recommended remediation?
Upgrade Erupt to version 2.4.0. The documented patch is 8d2eaffc79b977c9d11222b9d435a002dceaa062.