CVE-2026-95829: TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TDuckCloud tduck-platformto a version that resolves this vulnerability.Patch ea7f0fae7cb0fd998a3284c11addce689350cd69
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the assigned vector indicates low privileges are required. No user interaction is required.
Which deployments are affected?
TDuckCloud tduck-platform versions up to 5.3 are affected, specifically the Pagination Inner Interceptor implementation in MybatisPlusConfig.java. The vulnerable input is the orders[0].column argument passed to PaginationInnerInterceptor.concatOrderBy.
Is exploit code available?
Yes. A public exploit is available, which increases the likelihood that the issue may be used in attacks.
What should teams do to remediate this vulnerability?
Install the patch identified as ea7f0fae7cb0fd998a3284c11addce689350cd69. The provided data does not specify an alternative mitigation for environments where patching cannot be performed immediately.