CVE-2026-7678: YunaiV yudao-cloud SQL Injection Vulnerability

CVE-2026-7678 Overview

CVE-2026-7678 is a SQL injection vulnerability in YunaiV yudao-cloud through version 2026.01. The flaw resides in the getDataBySQL function within yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Attackers can manipulate query input to inject arbitrary SQL statements against the backend database. The vulnerability is remotely exploitable and requires only low-privileged authentication. A public exploit reference exists, and the vendor did not respond to disclosure attempts. The issue is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact

Authenticated remote attackers can execute arbitrary SQL queries against the yudao-cloud reporting database, exposing or modifying report data.

Affected Products

• YunaiV yudao-cloud versions up to and including 2026.01
• The yudao-module-report-biz reporting module
• The GoViewDataServiceImpl service component

Discovery Timeline

• 2026-05-03 - CVE-2026-7678 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7678

Vulnerability Analysis

The vulnerability lives in the getDataBySQL function of GoViewDataServiceImpl.java, part of the yudao-cloud reporting module. The function accepts SQL-related input from a request parameter and passes it to the database layer without sufficient sanitization or parameterization. Because the user-controlled value is concatenated into the executed query, attackers can break out of the intended statement and append arbitrary clauses. A public reference detailing the issue is available on GitHub and on VulDB entry #360831.

Root Cause

The root cause is improper neutralization of SQL syntax characters within input consumed by getDataBySQL. The method relies on direct string handling rather than prepared statements with bound parameters. This is consistent with [CWE-74] injection patterns where input flows into a downstream interpreter without proper escaping. The reporting module exposes this method through an authenticated endpoint, which is why low-privilege credentials are sufficient for exploitation.

Attack Vector

Exploitation occurs over the network against the reporting endpoint that wraps getDataBySQL. An attacker holding any low-privilege account submits a crafted payload containing additional SQL syntax. The injected statements run with the database privileges of the application service account. Possible outcomes include reading sensitive report data, enumerating schema, or modifying records depending on the database user's grants. According to the EPSS data published on 2026-05-07, the score is 0.026%, indicating low predicted exploitation activity at present.

No verified proof-of-concept code is reproduced here. The GitHub issue referenced in the disclosure describes the parameter and request flow used to trigger the injection.

Detection Methods for CVE-2026-7678

Indicators of Compromise

• HTTP requests to yudao-cloud reporting endpoints containing SQL meta-characters such as ', --, UNION SELECT, or ; in body or query parameters
• Application or database logs showing syntactically unusual statements originating from the GoViewDataServiceImpl service
• Repeated authenticated requests from a single low-privilege account targeting GoView report data APIs

Detection Strategies

• Inspect application access logs for parameters that feed into getDataBySQL and flag requests containing SQL keywords or boolean payloads such as OR 1=1
• Enable database query logging and correlate spikes in query length, error rate, or schema-introspection queries (information_schema) with yudao-cloud service traffic
• Deploy a web application firewall ruleset tuned for SQL injection signatures on the reporting module's URI prefix

Monitoring Recommendations

• Alert on authentication followed by anomalous report API usage patterns from the same session token
• Track outbound database errors surfaced to API responses, which often accompany injection probing
• Baseline normal report query volume per user and alert on deviation from that baseline

How to Mitigate CVE-2026-7678

Immediate Actions Required

• Restrict network exposure of the yudao-cloud reporting module to trusted internal users until a fix is available
• Audit and reduce privileges of the database account used by the application so it cannot read or modify data outside the report scope
• Rotate credentials for any low-privilege accounts that could be abused to reach the vulnerable endpoint
• Review database and application logs for prior exploitation attempts referencing getDataBySQL

Patch Information

No vendor patch is currently referenced in the public advisory. The vendor was contacted but did not respond to the disclosure. Operators should monitor the yudao-cloud project repository for an upstream fix and apply parameterized queries to getDataBySQL as an interim source-level remediation.

Workarounds

• Replace dynamic SQL construction in getDataBySQL with prepared statements using bound parameters
• Add a server-side allowlist for permitted SQL keywords or table names if the function must accept query fragments
• Enforce strict input validation on all request parameters reaching the reporting module and reject characters such as ;, --, /*, and '
• Block external access to the yudao-module-report-biz endpoints at the reverse proxy or API gateway layer

# Example reverse proxy rule to block SQL meta-characters on the reporting path
location ~* /report/.*goview { 
    if ($args ~* "(union|select|--|;|/\*|or\s+1=1)") { 
        return 403; 
    } 
    proxy_pass http://yudao_backend; 
}