CVE-2026-90511: GongShengyue OnlineBooks SQLi Vulnerability

CVE-2026-90511 Overview

CVE-2026-90511 is a SQL injection vulnerability in GongShengyue OnlineBooks, an open-source Java-based book management application. The flaw resides in the listSplit interface implemented in src/cn/ylcto/book/servlet/BooksServlet.java. Attackers can manipulate the column parameter to inject arbitrary SQL statements into backend queries. Exploitation requires only low-privilege network access and no user interaction. The affected commit is dfc5eacc08d3b0396c266049548618f6fb9587ea, and because the project uses a rolling release model, no fixed version is published. Public proof-of-concept documentation is available, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Authenticated remote attackers can inject SQL through the column parameter of the listSplit interface, potentially reading, modifying, or destroying data in the OnlineBooks database.

Affected Products

GongShengyue OnlineBooks up to commit dfc5eacc08d3b0396c266049548618f6fb9587ea
BooksServlet.java in src/cn/ylcto/book/servlet/
listSplit interface component

Discovery Timeline

2026-09-13 - CVE-2026-90511 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90511

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-74] in the listSplit interface of the OnlineBooks application. The affected code path is located in src/cn/ylcto/book/servlet/BooksServlet.java. User-supplied input to the column request parameter is concatenated directly into a SQL query without parameterization or input validation. An attacker with low-privileged access can submit a crafted column value that alters the intended query structure.

The exploit is publicly documented in a third-party proof-of-concept, which lowers the barrier for opportunistic attacks. Because OnlineBooks follows a rolling release model, no discrete patched version is published, which complicates remediation planning for defenders.

Root Cause

The root cause is unsanitized string concatenation when building the dynamic SQL statement used by the listSplit interface. The column parameter is intended to specify a sort or filter column, but the servlet does not enforce an allowlist and does not use PreparedStatement bind parameters. This design allows SQL metacharacters and clauses supplied through HTTP requests to be executed as part of the query.

Attack Vector

Exploitation occurs over the network against the HTTP endpoint served by BooksServlet. The attacker sends a request that includes a malicious column parameter containing SQL fragments such as UNION SELECT, boolean-based blind payloads, or time-based payloads. The server executes the concatenated statement against the backing database, returning data or triggering measurable side effects. Authentication at a low privilege level is required, according to the CVSS vector.

See the GitHub CVE PoC Documentation and the VulDB CVE Details for parameter-level exploitation details.

Detection Methods for CVE-2026-90511

Indicators of Compromise

HTTP requests to the OnlineBooks listSplit endpoint containing SQL metacharacters in the column parameter, such as single quotes, --, UNION, SLEEP(, or INFORMATION_SCHEMA.
Application or database logs showing malformed queries referencing unusual column expressions originating from BooksServlet.java.
Sudden spikes in database query latency correlated with requests to the listSplit interface, indicating potential time-based blind injection.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the column query parameter for SQL keywords and syntax outside of an approved column-name allowlist.
Enable verbose query logging on the backend database and alert on queries that reference BooksServlet sessions with syntactically anomalous ORDER BY or SELECT clauses.
Perform authenticated dynamic application security testing (DAST) against the listSplit endpoint using sqlmap or equivalent tooling to confirm exposure.

Monitoring Recommendations

Aggregate servlet access logs into a centralized analytics platform and build detections for high-entropy or excessively long column parameter values.
Monitor for authenticated user accounts issuing repeated failed queries followed by successful data-returning queries, a pattern typical of blind SQLi enumeration.
Correlate database error events with corresponding HTTP requests to identify probing activity against the listSplit interface.

How to Mitigate CVE-2026-90511

Immediate Actions Required

Restrict network access to OnlineBooks deployments so only trusted users can reach the listSplit endpoint until a code fix is applied.
Audit authentication and revoke or rotate low-privileged accounts that are not strictly necessary, since exploitation requires at least low privileges.
Review database and application logs for prior exploitation attempts referencing the column parameter.

Patch Information

GongShengyue OnlineBooks uses a rolling release model, and no discrete patched version has been published for CVE-2026-90511. Operators should pull the latest commit from the upstream repository and verify that the listSplit handler in BooksServlet.java uses parameterized queries with an allowlist for column names. Track the VulDB Vulnerability Overview for updates on any vendor-issued fix commit.

Workarounds

Modify BooksServlet.java locally to validate the column parameter against a strict allowlist of known column identifiers before use.
Refactor the affected SQL construction to use PreparedStatement with bound parameters, eliminating string concatenation for user-controlled input.
Deploy a WAF signature that blocks or sanitizes requests to the listSplit interface containing SQL syntax in the column parameter.
If the application is not required, take the deployment offline until code-level remediation is complete.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the column parameter
SecRule ARGS:column "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|information_schema|--|;)" \
    "id:1029051,phase:2,deny,status:403,log,msg:'CVE-2026-90511 OnlineBooks listSplit SQLi attempt'"