CVE-2026-5577: Song-Li cross_browser SQL Injection Flaw

CVE-2026-5577 Overview

A SQL Injection vulnerability has been identified in Song-Li cross_browser, affecting versions up to commit ca690f0fe6954fd9bcda36d071b68ed8682a786a. The vulnerability exists in the flask/uniquemachine_app.py file, specifically within the details endpoint. An attacker can manipulate the ID argument to inject malicious SQL queries, potentially compromising the underlying database. This vulnerability can be exploited remotely without authentication, and a public exploit has been disclosed.

Critical Impact

Remote attackers can exploit this SQL Injection flaw to extract sensitive data, modify database contents, or potentially escalate to further system compromise through the unauthenticated details endpoint.

Affected Products

• Song-Li cross_browser (up to commit ca690f0fe6954fd9bcda36d071b68ed8682a786a)
• Flask application component (flask/uniquemachine_app.py)
• Details Endpoint handling the ID parameter

Discovery Timeline

• 2026-04-05 - CVE-2026-5577 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5577

Vulnerability Analysis

This SQL Injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) occurs in the details endpoint of the Flask-based cross_browser application. The vulnerable code path fails to properly sanitize user-supplied input in the ID parameter before incorporating it into SQL queries.

The vulnerability allows remote, unauthenticated attackers to inject arbitrary SQL commands through the network-accessible endpoint. When a malicious payload is submitted via the ID parameter, the application constructs SQL queries using the unsanitized input, enabling attackers to manipulate database operations. The exploit has been publicly disclosed, increasing the risk of active exploitation in the wild.

Since this product follows a rolling release model, there is no specific version number to identify vulnerable or patched releases. The vendor was contacted regarding this disclosure but did not provide any response.

Root Cause

The root cause is improper input validation and lack of parameterized queries in the flask/uniquemachine_app.py file. The details endpoint directly incorporates user-controlled input from the ID parameter into SQL statements without sanitization or the use of prepared statements. This allows attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack can be executed remotely over the network. An unauthenticated attacker sends a specially crafted HTTP request to the details endpoint with a malicious ID parameter value containing SQL injection payloads. The application processes this input without validation, executing the injected SQL against the backend database.

The vulnerability mechanism involves improper handling of the ID parameter in the details endpoint. When an attacker supplies malicious input such as SQL metacharacters or injection payloads, the application fails to escape or parameterize this input, allowing the attacker's SQL commands to execute directly against the database. For detailed technical analysis and proof-of-concept information, refer to the GitHub Issue #24 Report and VulDB Vulnerability #355347.

Detection Methods for CVE-2026-5577

Indicators of Compromise

• Unusual SQL error messages or database exceptions in application logs originating from the details endpoint
• HTTP requests to the details endpoint containing SQL metacharacters (', ", ;, --, UNION, SELECT) in the ID parameter
• Unexpected database query patterns or data access anomalies
• Increased error rates or unusual response times from the Flask application

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter
• Implement application-level logging to capture all requests to the details endpoint with full parameter values
• Configure database activity monitoring to alert on anomalous query patterns or unauthorized data access
• Use intrusion detection systems (IDS) with signatures for common SQL injection payloads

Monitoring Recommendations

• Monitor HTTP access logs for requests to flask/uniquemachine_app.py details endpoint with suspicious ID parameter values
• Set up alerts for database errors indicating SQL syntax issues or injection attempts
• Review application logs for patterns consistent with SQL injection probing or exploitation
• Implement real-time monitoring of database queries for unauthorized SELECT, INSERT, UPDATE, or DELETE operations

How to Mitigate CVE-2026-5577

Immediate Actions Required

• Restrict network access to the vulnerable details endpoint until a patch is applied
• Implement input validation on the ID parameter to accept only expected formats (e.g., numeric values)
• Deploy WAF rules to block SQL injection attempts targeting the application
• Consider taking the affected endpoint offline if it is not critical to operations

Patch Information

No official patch is currently available. The vendor (Song-Li) was contacted regarding this vulnerability disclosure but did not respond. Since cross_browser uses a rolling release model, users should monitor the project repository for updates that address this SQL injection vulnerability. The vulnerable component is located at flask/uniquemachine_app.py in the details endpoint.

For more information, see the VulDB Submission #783502 and VulDB CTI Analysis #355347.

Workarounds

• Implement parameterized queries or prepared statements in the flask/uniquemachine_app.py file to prevent SQL injection
• Add strict input validation to ensure the ID parameter contains only expected alphanumeric characters
• Deploy a reverse proxy or WAF in front of the application to filter malicious requests
• Restrict database user permissions to limit the impact of successful SQL injection attacks

# Example WAF rule to block common SQL injection patterns
# Add to your web server or WAF configuration
# Block requests containing SQL injection keywords in the ID parameter
SecRule ARGS:ID "@rx (?i)(union|select|insert|update|delete|drop|--|;|'|\")" \
    "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Blocked'"