CVE-2026-4594 Details
Description
A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java. Such manipulation of the argument sort.field leads to sql injection hibernate. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A SQL injection vulnerability has been identified in Erupt versions through 1.13.3. The issue arises in the 'geneEruptHqlOrderBy' function within 'EruptJpaUtils.java', where the 'sort.field' parameter is improperly validated before being concatenated into the Hibernate Query Language (HQL) ORDER BY clause. This flaw allows authenticated attackers to inject arbitrary HQL expressions, potentially leading to cross-table data exfiltration using boolean-based blind injection techniques. The vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 23, 2026CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://fx4tqqfvdw4.feishu.cn/docx/ETWUdbPk1oCC56xoEWHc3Q28nEc?from=from_copylink | [email protected] | ExploitTechnical Description |
| https://vuldb.com/?ctiid.352431 | [email protected] | Content Wall |
| https://vuldb.com/?id.352431 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.775594 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-564 | SQL Injection: Hibernate | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| erupts erupt | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |