CVE-2026-8734: Oinone Pamirs SQL Injection Vulnerability

CVE-2026-8734 Overview

CVE-2026-8734 is a SQL injection vulnerability in Oinone Pamirs up to version 7.2.0. The flaw resides in the RSQLToSQLNodeConnector.makeVariable function of the queryListByWrapper interface component. Attackers can manipulate query inputs remotely without authentication to inject arbitrary SQL statements. The exploit has been publicly disclosed and may be utilized in active attacks. The vendor was contacted prior to disclosure but did not respond. This issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote, unauthenticated SQL injection against the queryListByWrapper interface allows attackers to read, modify, or extract backend database contents.

Affected Products

Oinone Pamirs versions up to and including 7.2.0
Component: queryListByWrapper Interface
Function: RSQLToSQLNodeConnector.makeVariable

Discovery Timeline

2026-05-17 - CVE-2026-8734 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8734

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input within the RSQLToSQLNodeConnector.makeVariable function. This function is invoked by the queryListByWrapper interface when translating RSQL filter expressions into backend SQL nodes. Because variable values are concatenated into SQL fragments without parameterization or contextual escaping, attacker-controlled tokens become part of the executed query.

The attack vector is network-based and requires no authentication or user interaction. An attacker submits crafted RSQL query parameters that include SQL meta-characters or sub-clauses. The injected payload modifies the resulting query, enabling data extraction, condition manipulation, or boolean-based and time-based blind enumeration of backend records.

This category of flaw maps to [CWE-74] injection weaknesses and is consistent with traditional first-order SQL injection patterns where user input traverses an ORM or query-builder layer that fails to bind values safely.

Root Cause

The root cause is the construction of SQL fragments via string assembly within makeVariable rather than the use of prepared statements with bound parameters. RSQL variable values entering the connector are treated as trusted SQL syntax instead of opaque data.

Attack Vector

A remote attacker sends an HTTP request to an endpoint exposing the queryListByWrapper interface and supplies an RSQL filter where a variable contains SQL syntax. The connector emits the value verbatim into the generated query, producing a modified execution plan against the application database. Technical details and proof-of-concept material are referenced in the GitHub Issue Discussion and VulDB Vulnerability #364322.

Detection Methods for CVE-2026-8734

Indicators of Compromise

HTTP requests to queryListByWrapper endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences (--, /*) inside RSQL filter values.
Database error responses or unusually long response times correlated with queryListByWrapper calls.
Unexpected reads against sensitive tables originating from the Oinone Pamirs application service account.

Detection Strategies

Inspect web access logs for RSQL filter parameters containing SQL meta-characters, quoting anomalies, or stacked-query indicators.
Enable database query logging and alert on queries from the Pamirs application that deviate from known parameterized templates.
Deploy a Web Application Firewall (WAF) signature targeting SQL injection patterns in RSQL == and =in= operator values.

Monitoring Recommendations

Continuously baseline outbound query patterns from the queryListByWrapper interface and flag deviations.
Monitor authentication-free endpoints for sudden volume spikes consistent with automated SQL injection scanning.
Correlate WAF, application, and database telemetry to confirm injection attempts that reach the backend.

How to Mitigate CVE-2026-8734

Immediate Actions Required

Restrict network exposure of the queryListByWrapper interface to trusted internal consumers until a fix is available.
Deploy WAF rules blocking SQL meta-characters in RSQL variable positions.
Audit database accounts used by Oinone Pamirs and enforce least privilege to limit blast radius of successful injection.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to disclosure attempts. Track the VulDB Vulnerability #364322 entry and the GitHub Issue Discussion for fix availability.

Workarounds

Place the application behind a reverse proxy that enforces strict input validation on RSQL query parameters.
Revoke write and schema privileges from the database user backing Pamirs to constrain attacker capability.
Disable or firewall the queryListByWrapper endpoint for unauthenticated callers where the application architecture permits.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in RSQL filter parameter
SecRule ARGS:filter "@rx (?i)(union\s+select|sleep\s*\(|benchmark\s*\(|--|/\*)" \
    "id:1026873401,phase:2,deny,status:403,log,\
    msg:'Potential SQL injection in RSQL filter (CVE-2026-8734)'"