SQL Injection Vulnerability in AipexBase Product by Kuafuai

CVE-2026-111718

What is CVE-2026-111718?

AipexBase has a vulnerability that allows for SQL injection through the order_by and group_by fields of the /api/data/invoke endpoint. This weakness enables attackers to inject malicious SQL queries, leveraging subqueries or XML extraction functions like EXTRACTVALUE and UPDATEXML. As a result, attackers may bypass existing security measures such as the SqlGuard denylist and row-level security, potentially gaining unauthorized access to other users' data.

References