CVE-2026-90511 Details
Description
A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
A SQL injection vulnerability has been identified in GongShengyue OnlineBooks versions prior to dfc5eacc08d3b0396c266049548618f6fb9587ea. The issue resides in the listSplit interface of the BooksServlet component, specifically within the file src/cn/ylcto/book/servlet/BooksServlet.java. The vulnerability arises because the 'column' parameter is directly concatenated into an SQL statement, allowing remote attackers to manipulate the WHERE clause or append UNION queries. This exploitation could lead to unauthorized data access from the backend database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hhhh333/CVE/blob/main/OnlineBooks-sql.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-90511 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/911884 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403099 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403099/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GongShengyue OnlineBooks | <= dfc5eacc08d3b0396c266049548618f6fb9587ea |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |