7.3
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.
Засегнати продукти
- YunaiV yudao-cloud: 2026.01
Вид слабост
История
- 30 март 2026 Публикувано
Други уязвимости в YunaiV yudao-cloud
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-5147
- https://nvd.nist.gov/vuln/detail/CVE-2026-5147
- https://vuldb.com/vuln/354181
- https://vuldb.com/vuln/354181/cti
- https://vuldb.com/cve/CVE-2026-5147
- https://vuldb.com/submit/780191
- https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/yudaoCloudv2026.01.md
- https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/yudaoCloudv2026.01.md#admin-apisystemtenantget-by-website
- https://gitee.com/zhijiantianya/yudao-cloud/commit/bccf7c79e5f93f027a021172a18e8876cc6c1062