CVE-2026-75132: WAPT Server SQL Injection via /api/v3/hosts Endpoint
WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point, an attacker can inject additional PostgreSQL statements, bypass the host scope restrictions applied to the account, and read information from other rows or tables within the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.1.17834
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote authenticated user with read-only privileges can exploit the vulnerable endpoint. No user interaction is required.
What data could an attacker access?
An attacker can bypass the host-scope restrictions assigned to their account and read information from other database rows or tables. The issue affects confidentiality; integrity and availability impacts are not identified in the provided data.
Which deployments are affected?
WAPT Server 2.6.1.17834 and earlier are affected when the GET /api/v3/hosts endpoint is accessible to authenticated read-only users.
How is the injection performed?
The attacker supplies PostgreSQL expressions through the columns parameter of the GET /api/v3/hosts endpoint. The application incorporates this parameter into a SQL query.