SQL Injection Vulnerability in erupts Erupt Software by Erupt Team
CVE-2026-124504

5.3MEDIUM

Key Information:

Vendor

Erupts

Status
Erupt
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124504?

A SQL injection vulnerability has been identified in the ReportService.queryBiData function of the erupts Erupt product, specifically affecting versions up to 2.3.0. This flaw allows remote attackers to manipulate the 'sort' argument, which could enable them to inject malicious SQL commands. Given that the exploit details are now public, it is crucial for users to upgrade to version 2.4.0, which includes a security patch to remediate this issue. The patch can be found at commit 8d2eaffc79b977c9d11222b9d435a002dceaa062, and users are urged to apply it promptly.

Affected Version(s)

erupt 2.0

erupt 2.1

erupt 2.2

References

https://vuldb.com/vuln/432808
vdb-entrytechnical-description
https://vuldb.com/vuln/432808/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124504
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
.