CVE-2026-75876: EasyReport SQL Injection Vulnerability

CVE-2026-75876 Overview

CVE-2026-75876 is a SQL injection vulnerability affecting xianrendzw EasyReport versions up to 2.0.17.0522_Beta. The flaw resides in the ModuleController.java file within the Move Operations component. Attackers can manipulate the sourcePath argument to inject arbitrary SQL statements against the backend database. The attack is executable remotely and requires low privileges. The exploit has been publicly disclosed, increasing the risk of opportunistic exploitation. Maintainers were notified through a public issue report but have not responded, leaving the codebase unpatched. This vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers with low privileges can inject SQL statements through the sourcePath parameter, potentially exposing or modifying database contents in unpatched EasyReport deployments.

Affected Products

xianrendzw EasyReport versions up to and including 2.0.17.0522_Beta
Component: Move Operations handler in ModuleController.java
Parameter: sourcePath

Discovery Timeline

2026-08-18 - CVE-2026-75876 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75876

Vulnerability Analysis

The vulnerability exists in the Move Operations functionality exposed by ModuleController.java in the EasyReport application. User-supplied input to the sourcePath argument is concatenated into a SQL query without proper parameterization or sanitization. An authenticated attacker sending a crafted request over the network can alter the query structure and execute injected SQL statements against the backend database.

EasyReport is a Java-based reporting platform commonly deployed within enterprise data environments. Successful exploitation can expose report data, user credentials, or configuration information stored in the database. The publicly disclosed exploit lowers the barrier for opportunistic scanning and abuse of exposed instances.

Root Cause

The root cause is missing input neutralization on the sourcePath parameter before it reaches the data access layer. The controller passes attacker-controlled string data directly into a dynamic SQL statement. This pattern falls under [CWE-74], where special characters embedded in input are interpreted as SQL syntax rather than data values.

Attack Vector

An attacker sends an HTTP request to the Move Operations endpoint with a malicious sourcePath value. The payload breaks out of the intended string context and appends attacker-controlled SQL. Because the attack traverses the network and requires only low privileges, any user account with access to the reporting interface can trigger the injection. No user interaction is required.

See the GitHub Issue Discussion and VulDB CVE Record for additional technical context on the affected code path.

Detection Methods for CVE-2026-75876

Indicators of Compromise

HTTP requests to EasyReport endpoints containing SQL metacharacters (', --, ;, UNION, SELECT) in the sourcePath parameter.
Unexpected database errors in EasyReport application logs correlated with Move Operations requests.
Anomalous outbound database query volume originating from the EasyReport application server.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect sourcePath parameter values for SQL injection signatures.
Enable database query auditing to log statements originating from the EasyReport service account and flag syntactically anomalous queries.
Correlate application error logs with authentication events to identify low-privilege accounts probing the Move Operations endpoint.

Monitoring Recommendations

Monitor HTTP access logs for requests to ModuleController endpoints containing URL-encoded quote characters or SQL keywords.
Track failed and successful database queries invoked by EasyReport for statement patterns inconsistent with normal report operations.
Alert on any privilege escalation or data exfiltration behavior originating from the EasyReport host.

How to Mitigate CVE-2026-75876

Immediate Actions Required

Restrict network access to EasyReport instances to trusted internal networks or place them behind an authenticated reverse proxy.
Revoke unnecessary user accounts and enforce least-privilege database credentials for the EasyReport service.
Deploy WAF rules to block SQL injection payloads targeting the sourcePath parameter until an upstream fix is available.

Patch Information

No vendor patch is available at the time of publication. According to the VulDB Vulnerability Info, the project maintainer was notified through the GitHub Issue Discussion but has not responded. Organizations should monitor the GitHub PoC Repository for updates and consider migrating to an actively maintained reporting platform.

Workarounds

Apply a reverse-proxy filter that rejects requests where sourcePath contains SQL metacharacters or exceeds expected length.
Configure the EasyReport database account with read-only privileges on non-report tables to limit injection impact.
Disable or restrict access to the Move Operations functionality if it is not required for business operations.

bash

# Example nginx location block to filter suspicious sourcePath values
location /module/ {
    if ($arg_sourcePath ~* "(\'|--|;|union|select|insert|update|delete)") {
        return 403;
    }
    proxy_pass http://easyreport_backend;
}