CVE-2026-75334: Smart-web2 vulnerability
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save() interface and directly embedded into Hibernate native queries without any parameterization or filtering.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs access to the backend ReportController.save() interface so they can supply a malicious sqlResource.sql value. The provided data does not establish whether that interface requires authentication or which user roles can reach it.
Where is the malicious SQL stored and when is it executed?
The supplied sqlResource.sql value is stored in the t_report_sql_resource table. It is executed when the stored value is embedded in a Hibernate native query without parameterization or filtering.
Are installations other than v1.3.1 known to be affected?
The provided information identifies smart-web2 v1.3.1 as affected. It does not provide evidence about other versions or whether a fixed version is available.