CVE-2026-79570: mfish-nocode-pro SQL Injection Vulnerability

CVE-2026-79570 is a SQL injection vulnerability in mfish-nocode-pro v1.0.0 affecting the tableName parameter. Attackers can exploit this flaw to access sensitive database information through crafted SQL statements. This article covers technical details, affected versions, potential impact, and mitigation strategies.

CVE-2026-79570 Overview

CVE-2026-79570 is a SQL injection vulnerability in mfish-nocode-pro v1.0.0. The flaw resides in the tableName parameter of the /sys/dbConnect/data endpoint. Attackers can submit crafted SQL statements to access sensitive database information without authentication. The vulnerability is exploitable over the network with low complexity and requires no user interaction. It is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary database contents and potentially modify records by injecting SQL via the tableName parameter.

Affected Products

mfish-nocode-pro v1.0.0
Endpoint: /sys/dbConnect/data
Vulnerable parameter: tableName

Discovery Timeline

2026-09-08 - CVE-2026-79570 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79570

Vulnerability Analysis

The vulnerability exists in the database connection data-retrieval handler at /sys/dbConnect/data. The application accepts a tableName value from the client and concatenates it into a backend SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

Because tableName typically represents an identifier rather than a value, the application likely constructs statements through string interpolation rather than prepared statements. Identifier-based injection is particularly dangerous because parameterized queries cannot bind identifiers directly, and developers often skip validation on such inputs. An attacker can enumerate schemas, dump credentials, and pivot to other data stores reachable through the configured connection.

Root Cause

The root cause is missing input validation and improper query construction in the /sys/dbConnect/data handler. The tableName parameter is inserted directly into a SQL statement without allowlist validation or escaping. This is a textbook [CWE-89] weakness.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to /sys/dbConnect/data with a malicious tableName payload. The attacker can use UNION-based, error-based, or time-based blind injection techniques to extract data. Refer to the GitHub PoC Repository for the published proof-of-concept demonstrating exploitation.

No verified sanitized exploitation code is available in the enriched data. See the linked PoC for technical details.

Detection Methods for CVE-2026-79570

Indicators of Compromise

HTTP requests to /sys/dbConnect/data containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* within the tableName parameter.
Unusual outbound database query volume or long-running queries originating from the mfish-nocode-pro application user.
Application or database error messages referencing malformed SQL syntax tied to tableName values.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the tableName parameter for SQL syntax and reject non-alphanumeric identifiers.
Enable database query logging and alert on queries referencing information_schema, pg_catalog, or mysql.user originating from the application service account.
Correlate HTTP access logs with database audit logs to identify anomalous query patterns tied to specific request IDs.

Monitoring Recommendations

Baseline normal traffic to /sys/dbConnect/data and alert on spikes, oversized parameters, or requests from unexpected source IPs.
Monitor for authentication failures immediately followed by successful data access, which may indicate credential extraction via injection.
Forward application, WAF, and database logs to a centralized analytics platform for cross-source correlation and retention.

How to Mitigate CVE-2026-79570

Immediate Actions Required

Restrict network access to the /sys/dbConnect/data endpoint to trusted administrative networks only.
Deploy WAF signatures that block SQL metacharacters and keywords in the tableName parameter.
Rotate database credentials configured within mfish-nocode-pro if exposure is suspected.
Review database audit logs for prior exploitation activity dating back to deployment.

Patch Information

No vendor patch or advisory URL is listed in the enriched CVE data at this time. Monitor the mfish-nocode-pro project repository for an official fix. Until a patch is available, apply the workarounds below and reduce the exposure of affected instances.

Workarounds

Enforce strict allowlist validation on the tableName parameter, accepting only known table identifiers.
Refactor the query to use identifier quoting and validation rather than raw string concatenation.
Run the application database account with least privilege, limiting SELECT scope and denying access to system catalogs where feasible.
Place the application behind an authenticated reverse proxy if administrative endpoints must remain reachable.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in tableName
SecRule ARGS:tableName "@rx (?i)(union|select|insert|update|delete|drop|--|/\*|;)" \
    "id:1079570,phase:2,deny,status:403,msg:'CVE-2026-79570 SQLi attempt on tableName'"