SQL Injection Vulnerability in Apache OFBiz 24.09 on MySQL/MariaDB

CVE-2026-81815

What is CVE-2026-81815?

A SQL Injection vulnerability exists in Apache OFBiz 24.09 prior to version 24.09.08 for MySQL/MariaDB environments. This flaw allows an unauthenticated remote attacker to disclose sensitive information by crafting an ignore-case find request that leads to improper handling of SQL parameters. The vulnerability arises from the EntityFunction-wrapped value being directly embedded into SQL queries instead of being properly parameterized, specifically utilizing ANSI-only single-quote doubling. This issue is exacerbated in MySQL/MariaDB due to their handling of backslash escapes, permitting an attacker to manipulate the SQL query's WHERE clause to retrieve arbitrary data. For protection, users are urged to upgrade to version 24.09.08 or later.

References