CVE-2026-110614
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support…
- Risk score
- 47/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/Yiuman/citrus
- https://github.com/Yiuman/citrus/blob/0.15.0/citrus-support/src/main/java/com/github/yiuman/citrus/support/crud/query/QueryHelper.java#L123-L129
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli
- https://www.vulncheck.com/advisories/yiuman-citrus-through-0.15.0-order-by-sql-injection-via-sortby-parameter
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli
Original description
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
Last activity 14 Oct 2026. Patch Forecast updates every hour.