CVE-2026-75334: smart-web2 SQL Injection Vulnerability

CVE-2026-75334 Overview

CVE-2026-75334 is a SQL injection vulnerability in the report module of smart-web2 v1.3.1. The ReportController.save() interface accepts a sqlResource.sql parameter and stores it in the t_report_sql_resource table. The application later embeds this value directly into Hibernate native queries without parameterization or input filtering. Authenticated attackers can execute arbitrary SQL statements against the backing database.

Critical Impact
Attackers can read, modify, or destroy database contents by injecting arbitrary SQL through the report module, potentially leading to full data compromise.

Affected Products

smart-web2 v1.3.1
smart-web2 report module (ReportController component)
Deployments using the t_report_sql_resource table for report definitions

Discovery Timeline

2026-08-26 - CVE-2026-75334 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75334

Vulnerability Analysis

The report module exposes an administrative interface that saves user-supplied SQL statements as report definitions. The sqlResource.sql parameter passes through the ReportController.save() method and is persisted in the t_report_sql_resource table. When a report executes, the backend retrieves the stored string and concatenates it into a Hibernate native query.

Because the stored SQL is treated as trusted query text rather than data, any attacker with access to the report save endpoint controls the full query. This class of flaw maps to SQL Injection [CWE-89]. The vulnerability is a second-order injection: the payload is stored first and executed later when the report runs.

Root Cause

The root cause is the absence of parameterization and input filtering on the sqlResource.sql field. Hibernate native queries execute the stored string verbatim. The design treats a user-controllable field as query logic, violating the separation between code and data.

Attack Vector

An attacker with access to the report management interface submits a crafted sqlResource.sql value through the ReportController.save() endpoint. The payload persists in t_report_sql_resource. When the report is executed, the injected SQL runs with the privileges of the application database user. Impact includes arbitrary data read, data modification, and, depending on database configuration, command execution through database-specific features.

See the GitHub PoC for SQL Injection for reproduction steps.

Detection Methods for CVE-2026-75334

Indicators of Compromise

Unexpected rows in the t_report_sql_resource table containing SQL keywords such as UNION, INTO OUTFILE, xp_cmdshell, or INFORMATION_SCHEMA references.
Application logs showing calls to ReportController.save() followed by report execution from the same session.
Database audit logs recording queries that reference tables outside the normal report scope.

Detection Strategies

Review persisted values in t_report_sql_resource for statements that deviate from expected SELECT-only report logic.
Enable Hibernate SQL logging and alert on queries containing stacked statements, comments used for truncation, or schema enumeration patterns.
Correlate authentication events with report-save and report-execute actions to identify low-privilege accounts abusing the interface.

Monitoring Recommendations

Forward web application and database logs to a centralized analytics platform and alert on anomalous report queries.
Track the volume and content of writes to t_report_sql_resource per user account.
Monitor the application database user for privilege changes, new logins, or execution of administrative stored procedures.

How to Mitigate CVE-2026-75334

Immediate Actions Required

Restrict access to the report module and ReportController.save() endpoint to trusted administrators only.
Audit existing rows in t_report_sql_resource and remove any entries containing unexpected DDL, DML, or system procedure calls.
Reduce database privileges for the application account to the minimum required for report execution.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-75334 at the time of publication. Consult the GitHub PoC for SQL Injection for technical details, and monitor the smart-web2 project repository for a fixed release.

Workarounds

Disable or remove the report save functionality until a fix is available.
Place the report module behind an authenticated reverse proxy that enforces role-based access control.
Implement an allowlist that validates saved SQL against a set of approved templates before persisting to t_report_sql_resource.
Deploy a web application firewall rule to block SQL metacharacters in the sqlResource.sql parameter for non-administrator sessions.

bash

# Example: revoke non-essential privileges from the application DB user (MySQL)
REVOKE ALL PRIVILEGES ON *.* FROM 'smartweb2_app'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE ON smartweb2.* TO 'smartweb2_app'@'%';
FLUSH PRIVILEGES;