Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110609Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Medium 6.5

In plain English

A medium-severity SQL injection in skyeye from dromara. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.

Affected products (as reported)

Vendor	Product	Versions
dromara	skyeye	0 – through 65d3ddcede701d33ea5416e47c9b656e47d56401

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli third-party-advisory
https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/resources/mapper/erp/StatisticsMapper.xml#L29-L31 technical-description
https://github.com/dromara/skyeye/blob/65d3ddcede701d33ea5416e47c9b656e47d56401/skyeye-erp/erp-pro/src/main/java/com/skyeye/controller/StatisticsController.java#L33-L45 technical-description
https://github.com/dromara/skyeye product
VulnCheck Advisory: Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter third-party-advisory