CVE-2026-7678 Details
Description
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A SQL injection vulnerability has been identified in YunaiV yudao-cloud versions prior to 2026.01. The issue resides in the 'getDataBySQL' method of the 'GoViewDataServiceImpl' class, within the 'yudao-module-report-biz' module. This vulnerability allows authenticated users with the 'report:go-view-data:get-by-sql' permission to execute arbitrary SQL queries. The 'getDataBySQL' method directly executes user-provided SQL without proper validation or parameterization, enabling attackers to inject malicious SQL code. Exploitation of this vulnerability could lead to unauthorized data access, data manipulation, and database compromise.
It is recommended to implement parameterized queries to prevent SQL injection. If direct SQL execution is necessary, validate the SQL against a whitelist of allowed patterns before execution. Alternatively, consider removing the endpoint entirely and using prepared statements or stored procedures instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 3, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/9str0IL/CVE/issues/2 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/800865 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360831 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360831/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YunaiV yudao-cloud | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 3, 2026 | New CVE Received | [email protected] |