CVE-2026-110614 Details
Description
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
A SQL injection vulnerability has been identified in the Yiuman Citrus framework, specifically in versions through 0.15.0. The issue resides within the 'citrus-support' module, which handles generic queries for controllers extending 'BaseQueryController' or 'BaseQueryRestful'. The vulnerability allows users to inject unvalidated SQL into the ORDER BY clause via the 'sortBy' request parameter. Exploitation of this flaw could lead to unauthorized data extraction from the database using boolean- or time-based blind SQL injection techniques.
The vulnerability can be addressed by validating the 'sortBy' parameter against an allowlist of known columns before it is processed. This ensures that only recognized and safe column names are used in the ORDER BY clause, preventing SQL injection. Additionally, keeping the generic list routes behind proper authorization checks can help mitigate the risk by restricting access to authenticated users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/Yiuman/citrus | [email protected] | Vendor |
| https://github.com/Yiuman/citrus/blob/0.15.0/citrus-support/src/main/java/com/github/yiuman/citrus/support/crud/query/QueryHelper.java#L123-L129 | [email protected] | Source CodeVendor |
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/yiuman-citrus-through-0.15.0-order-by-sql-injection-via-sortby-parameter | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yiuman citrus | <= 0.15.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |