CVE-2026-110609 Details

A SQL injection vulnerability has been identified in the Dromara Skyeye ERP module, specifically within the Statistics Controller. This vulnerability allows authenticated low-privileged users to inject SQL through the 'keyword' parameter in the 'queryErpOrderItem' MyBatis statement. The issue arises from the use of raw '${}' substitution, which enables attackers to manipulate SQL queries and extract sensitive database information, including data from other tenants, using various techniques such as boolean, UNION, error, or time-based payloads.

The vulnerability can be fixed by replacing the raw '${keyword}' substitution with a parameter binding using '#{keyword}' and auditing other similar usages in the MyBatis mapper files.