CVE-2026-52472: Wgcloud 3.6.4 SQL Injection Vulnerability

CVE-2026-52472 Overview

CVE-2026-52472 is a SQL injection vulnerability in Wgcloud 3.6.4, an open-source server and IT infrastructure monitoring platform. The flaw resides in the PortInfoMapper.xml MyBatis mapper file, where user-supplied input is concatenated into SQL statements without proper parameterization. Remote attackers can exploit this weakness over the network without authentication or user interaction. Successful exploitation allows privilege escalation, data exfiltration, and full compromise of the underlying database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL, escalate privileges, and access or modify all data stored in the Wgcloud database.

Affected Products

Wgcloud 3.6.4
Deployments exposing the Wgcloud web interface to untrusted networks
Environments running the vulnerable PortInfoMapper.xml MyBatis configuration

Discovery Timeline

2026-07-21 - CVE-2026-52472 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-52472

Vulnerability Analysis

Wgcloud uses MyBatis mapper XML files to construct SQL queries against its backend database. In the vulnerable PortInfoMapper.xml file, one or more query definitions embed user-controllable parameters directly into the SQL string using MyBatis ${} substitution instead of the safer #{} parameter binding. The ${} syntax performs raw string concatenation, bypassing prepared statement protection. An attacker who reaches the endpoint invoking this mapper can inject arbitrary SQL fragments into the executed query. Because Wgcloud exposes monitoring endpoints over HTTP, the attack surface is directly reachable across the network. The Exploit Prediction Scoring System currently rates this issue at 0.383%, but a public proof-of-concept already lowers the practical barrier to exploitation.

Root Cause

The root cause is unsafe SQL construction in the PortInfoMapper.xml MyBatis mapper. Parameters flowing from HTTP request handlers into the mapper are interpolated as strings rather than bound as query parameters. This eliminates the database driver's ability to distinguish code from data, permitting attacker-controlled clauses to alter query semantics.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the Wgcloud endpoint that invokes the vulnerable PortInfoMapper query. The injected payload can enumerate database schemas, extract credential material, insert or modify records, and depending on database privileges, execute administrative functions. Because Wgcloud accounts and monitoring targets are stored in the same database, attackers can leverage the flaw to escalate privileges within the application itself.

A public proof-of-concept is published at the GitHub PoC SQL Injection writeup, which documents the vulnerable parameter and payload structure.

Detection Methods for CVE-2026-52472

Indicators of Compromise

HTTP requests to Wgcloud endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in parameters bound to port information queries.
Unexpected database errors or long-running queries originating from the Wgcloud application user.
New or modified administrative accounts in the Wgcloud account table without corresponding UI activity.
Outbound connections from the Wgcloud host to attacker-controlled infrastructure following anomalous request patterns.

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting Wgcloud port-info endpoints with encoded quotes, boolean-based payloads, or time-based delays.
Enable MyBatis and JDBC query logging to capture SQL statements containing concatenated user input rather than parameter placeholders.
Deploy a web application firewall rule set that flags SQL injection signatures against Wgcloud URI paths.

Monitoring Recommendations

Monitor database audit logs for SELECT, UNION, or INFORMATION_SCHEMA queries originating from the Wgcloud service account outside normal operational patterns.
Alert on privilege changes, credential table reads, or bulk data exports from the Wgcloud schema.
Correlate anomalous HTTP request volume with database CPU or query-latency spikes on the Wgcloud backend.

How to Mitigate CVE-2026-52472

Immediate Actions Required

Restrict network access to the Wgcloud management interface to trusted administrative networks or VPN clients until a fixed release is applied.
Rotate all credentials stored in or accessible from the Wgcloud database, including monitoring agent secrets and admin accounts.
Review database audit logs for evidence of injection attempts referencing PortInfoMapper endpoints.
Place Wgcloud behind a web application firewall configured with SQL injection detection.

Patch Information

At the time of publication, no vendor advisory or fixed release is referenced in the NVD entry. Administrators should track the Wgcloud project repository for an updated version that replaces ${} substitution with #{} parameter binding in PortInfoMapper.xml and apply that release as soon as it becomes available. Refer to the GitHub PoC SQL Injection writeup for the specific parameter that must be sanitized.

Workarounds

Block access to the vulnerable Wgcloud endpoint at the reverse proxy or WAF layer until an official fix is available.
Enforce least-privilege for the Wgcloud database account so it cannot read system catalogs, create users, or write to unrelated schemas.
Deploy database-level query allowlisting or a SQL firewall to reject statements containing UNION, INFORMATION_SCHEMA, or stacked queries from the Wgcloud application user.

bash

# Example nginx snippet restricting access to the Wgcloud management interface
location /wgcloud/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://127.0.0.1:9999/wgcloud/;
}