CVE-2026-9524: xianrendzw EasyReport REST Endpoint execute sql injection
A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
xianrendzw EasyReportfrom your environment.Uninstall or take the EasyReport installation offline if the application is not required or cannot be securely operated.
- Configuration
Disable the REST 'execute' endpoint (or otherwise disable processing of reportParams) until a vendor patch or code fix is available.
xianrendzw EasyReport REST Endpoint execute endpoint = disabled - Compensating control
Restrict access to the application REST interface to trusted IPs via firewall/ACLs and place the service behind a WAF or similar detection/prevention layer configured to block SQL injection payloads.
- Compensating control
If you maintain the code, implement input validation and use parameterized queries/prepared statements for handling reportParams to eliminate SQL injection vectors; deploy these code changes as soon as possible.
- Operational
Monitor application and database logs for signs of exploitation, perform incident response if suspicious activity is found, and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9524?
The severity of CVE-2026-9524 is rated medium with a score of 6.3.
What is the impact of CVE-2026-9524?
CVE-2026-9524 allows for remote SQL injection through manipulation of the reportParams argument.
How do I fix CVE-2026-9524?
To fix CVE-2026-9524, update xianrendzw EasyReport to the latest version that addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-9524?
CVE-2026-9524 is classified as a SQL Injection vulnerability.
Who is affected by CVE-2026-9524?
Users of xianrendzw EasyReport versions up to 2.0.17.0522_Beta are affected by CVE-2026-9524.