CVE-2026-52348 is a critical SQL injection vulnerability affecting cool-admin-java version 8.0.0. The flaw exists in the order() method of the CrudOption.java source file, allowing remote attackers to inject malicious SQL queries. This can lead to unauthorized data access, modification, or deletion, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction. No patch or official remediation has been published as of the data provided.

Successful exploitation of this vulnerability can result in complete compromise of the affected system's database, including unauthorized data disclosure, data manipulation, and potential denial of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply any available workarounds or input validation controls to mitigate SQL injection risks in the order() method. Monitor vendor channels for updates and patches addressing this vulnerability.