CVE-2026-37429: qihang-wms SQL Injection Vulnerability

CVE-2026-37429 Overview

CVE-2026-37429 is a SQL injection vulnerability in qihang-wms commit 75c15a, an open-source warehouse management system. The flaw resides in the datascope parameter handled by the SysUserMapper.xml MyBatis mapper file. Attackers can submit crafted SQL statements through this parameter to extract sensitive data from the backing database, including users' Personally Identifiable Information (PII). The vulnerability is exploitable over the network with low attack complexity and does not require user interaction. It is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated network-accessible SQL injection enabling disclosure of user PII and other sensitive database records stored by the qihang-wms application.

Affected Products

qihang-wms warehouse management system at commit 75c15a
Deployments using the vulnerable SysUserMapper.xml MyBatis mapper
Forks or downstream builds that inherit the unsanitized datascope parameter

Discovery Timeline

2026-05-13 - CVE-2026-37429 published to the National Vulnerability Database
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-37429

Vulnerability Analysis

The vulnerability exists in the MyBatis XML mapper SysUserMapper.xml, where the datascope parameter is concatenated into a SQL query without proper sanitization or parameterization. MyBatis mappers that use the ${} substitution syntax inline raw values directly into the generated SQL string, in contrast to the #{} syntax that produces bound prepared-statement parameters. When the application accepts datascope from a request and passes it to the mapper, an attacker can inject SQL fragments that alter the query's logic.

Successful exploitation lets an attacker read arbitrary records, including user account data and PII, from any table the application database account can access. The CWE-89 classification reflects improper neutralization of special elements in an SQL command. Public technical write-ups for this issue are available in the GitHub CVE SQL Injection Doc and the associated GitHub Gist Resource.

Root Cause

The root cause is unsafe SQL construction in SysUserMapper.xml. The datascope parameter is interpolated directly into the SQL statement rather than bound through a parameterized query. The application performs no allow-list validation or escaping before the value reaches the mapper.

Attack Vector

The vulnerability is reachable over the network. An attacker sends an HTTP request to an endpoint that propagates the datascope value into the affected mapper. A crafted payload using UNION SELECT, boolean-based, or time-based techniques can enumerate schema metadata and exfiltrate user records. No authentication or user interaction is required to reach the injection point.

No verified proof-of-concept code is published in the CVE record. Refer to the external write-ups linked above for payload examples documented by the reporter.

Detection Methods for CVE-2026-37429

Indicators of Compromise

HTTP requests containing SQL meta-characters such as ', --, UNION, SELECT, SLEEP(, or BENCHMARK( in the datascope parameter
Application or database logs showing query errors referencing SysUserMapper or malformed datascope clauses
Repeated requests from a single source iterating over schema or table names

Detection Strategies

Inspect web access logs for requests targeting qihang-wms endpoints that include the datascope parameter with non-standard values
Enable database query logging and alert on queries originating from SysUserMapper that contain UNION, stacked statements, or comment sequences
Deploy a web application firewall (WAF) ruleset tuned for SQL injection signatures against the qihang-wms application path

Monitoring Recommendations

Monitor outbound data volume from the qihang-wms database for anomalous read patterns suggesting bulk exfiltration
Track failed and successful authentication events for the database account used by qihang-wms to identify follow-on activity
Correlate WAF blocks, application 500 errors, and database error logs to surface injection attempts that bypass single-layer controls

How to Mitigate CVE-2026-37429

Immediate Actions Required

Restrict network access to the qihang-wms application to trusted users and source addresses until a patched build is deployed
Audit SysUserMapper.xml and replace any ${datascope} interpolation with parameterized #{datascope} bindings or strict allow-list validation
Reduce the privileges of the database account used by qihang-wms to the minimum required tables and operations
Review database and application logs for prior exploitation attempts referencing the datascope parameter

Patch Information

No official vendor patch advisory is referenced in the CVE record at the time of publication. Operators should monitor the qihang-wms upstream repository for fixes after commit 75c15a and apply mitigations described in the GitHub CVE SQL Injection Doc.

Workarounds

Place the application behind a WAF with SQL injection signatures enabled for the affected endpoints
Validate datascope server-side against a fixed allow-list of expected scope identifiers before invoking the mapper
Disable or remove unused endpoints that expose the datascope parameter where business logic allows

bash

# Configuration example: minimal ModSecurity rule to block SQLi patterns in the datascope parameter
SecRule ARGS:datascope "@rx (?i)(union(\s|/\*.*\*/)+select|--|/\*|;|\bsleep\s*\(|\bbenchmark\s*\()" \
    "id:1037429,phase:2,deny,status:403,log,msg:'CVE-2026-37429 qihang-wms datascope SQLi attempt'"