CVE-2026-110609: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dromara skyeye

CVE-2026-110609 is an SQL injection vulnerability in Dromara Skyeye through commit 65d3ddcede70 affecting version 0. The vulnerability arises from improper neutralization of special elements in the keyword parameter of the queryErpOrderItem MyBatis statement, which uses raw ${} substitution. Authenticated users with low privileges can exploit this flaw by sending crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints, enabling extraction of database data, including other tenants' data, via boolean, UNION, error, or time-based SQL injection techniques.

The vulnerability allows authenticated low-privileged users to perform SQL injection attacks, potentially leading to unauthorized disclosure of sensitive database information, including data belonging to other tenants. This compromises data confidentiality and could lead to further exploitation depending on the database contents and environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected endpoints and monitor for suspicious activity related to SQL injection attempts. Avoid using raw ${} substitution in SQL queries and implement proper parameterized queries or prepared statements.