CVE-2026-110609Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Description

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli third-party-advisory
• https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/r… technical-description
• https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/j… technical-description
• https://github.com/dromara/skyeye product
• VulnCheck Advisory: Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter third-party-advisory