CVE-2026-95829: TDuckCloud tduck-platform SQL Injection

CVE-2026-95829 Overview

CVE-2026-95829 is a SQL injection vulnerability in TDuckCloud tduck-platform versions up to 5.3. The flaw resides in the PaginationInnerInterceptor.concatOrderBy function within tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java. Attackers can manipulate the orders[0].column argument to inject arbitrary SQL statements into database queries. The vulnerability is remotely exploitable and requires only low-privileged authentication. A public exploit is available, and the vendor has released a patch identified by commit ea7f0fae7cb0fd998a3284c11addce689350cd69.

Critical Impact
Authenticated remote attackers can inject SQL through the pagination order-by parameter, potentially exposing or modifying data stored in the underlying database.

Affected Products

TDuckCloud tduck-platform versions up to and including 5.3
Component: Pagination Inner Interceptor (MybatisPlusConfig.java)
Related module: tduck-api (survey form platform)

Discovery Timeline

2026-09-23 - CVE-2026-95829 published to NVD
2026-09-23 - Last updated in NVD database
Patch commit - ea7f0fae7cb0fd998a3284c11addce689350cd69 published to the TDuckCloud repository

Technical Details for CVE-2026-95829

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The PaginationInnerInterceptor.concatOrderBy method concatenates the client-supplied orders[0].column value directly into an ORDER BY clause without validation or parameterization. MyBatis-Plus pagination interceptors typically rebuild the SQL string at runtime, which makes any unsanitized order column a direct injection point. An attacker can append arbitrary SQL fragments, subqueries, or time-based payloads to influence query execution. Because MyBatis-Plus routes the interceptor through the standard query lifecycle, the injected fragment executes with the same database permissions as the application service account. Exploitation requires only low-privileged network access and no user interaction.

Root Cause

The root cause is unsanitized string concatenation of a user-controlled sort column into a raw SQL fragment. ORDER BY clauses cannot be parameterized through JDBC bind variables, so developers must apply strict allow-list validation. The affected code lacked such validation, allowing attacker-supplied identifiers to pass through directly to the SQL layer.

Attack Vector

The attack is executed over the network against any REST endpoint that consumes the vulnerable pagination interceptor. An authenticated attacker submits a crafted JSON body or query string containing a malicious orders[0].column value. The interceptor appends the value to the outbound query, and the database executes the injected statement. Blind, error-based, and time-based extraction techniques are all applicable depending on the driver and query context.

java

// Source: https://github.com/TDuckCloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69
// Patch excerpt — controller migrated away from raw Page pagination
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
 import com.tduck.cloud.common.util.SecurityUtils;
-import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.tduck.cloud.common.entity.PageRequest;
 import com.tduck.cloud.common.util.QueryWrapperUtils;
 import com.tduck.cloud.common.util.Result;
 import com.tduck.cloud.form.entity.FormTemplateCategoryEntity;

The patch replaces the raw MyBatis-Plus Page object with a hardened PageRequest wrapper that validates sort columns before they reach the interceptor. See the GitHub Commit Details for the full diff.

Detection Methods for CVE-2026-95829

Indicators of Compromise

HTTP requests containing orders[0].column parameters with SQL keywords such as SELECT, UNION, SLEEP, CASE WHEN, or comment sequences (--, /*).
Database logs showing malformed or unexpected ORDER BY clauses referencing subqueries or conditional expressions.
Application error logs from MyBatis-Plus reporting SQL syntax exceptions tied to pagination queries.
Anomalous query latency on endpoints backed by PaginationInnerInterceptor, indicating potential time-based blind injection.

Detection Strategies

Deploy web application firewall rules that inspect JSON and query parameters named orders, column, and sort for SQL metacharacters.
Enable MyBatis-Plus SQL logging in staging environments to identify unsafe ORDER BY concatenation patterns.
Correlate authenticated session identifiers with abnormal query volumes against tduck-platform endpoints.

Monitoring Recommendations

Forward application and database logs to a centralized analytics platform and alert on SQL error spikes from tduck-platform hosts.
Track outbound database connections for unexpected data volumes originating from the tduck service account.
Monitor for repeated 500-series HTTP responses on pagination-backed API routes.

How to Mitigate CVE-2026-95829

Immediate Actions Required

Upgrade TDuckCloud tduck-platform to a release that includes commit ea7f0fae7cb0fd998a3284c11addce689350cd69.
Audit application logs for prior requests containing suspicious orders[0].column payloads.
Restrict access to tduck-platform administrative and API endpoints to trusted networks until patching is complete.
Rotate database credentials used by the tduck service account if exploitation is suspected.

Patch Information

The vendor fix is available in the upstream repository under commit ea7f0fae7cb0fd998a3284c11addce689350cd69. The patch refactors pagination handling to use a PageRequest abstraction that validates sort columns before invoking the MyBatis-Plus interceptor. Review the GitHub Commit Details and the VulDB CVE-2026-95829 entry for further technical context.

Workarounds

Implement a reverse-proxy or WAF rule that rejects requests where orders[*].column contains characters outside [A-Za-z0-9_].
Enforce an application-side allow-list of sortable column names before passing values to the pagination interceptor.
Reduce database privileges of the tduck service account to the minimum required for read and write operations, blocking DDL and system-level access.

bash

# Example nginx rule to block SQL metacharacters in the orders parameter
if ($args ~* "orders(\[|%5B)0(\]|%5D)\.column=[^&]*([';\"]|--|/\*|union|select|sleep|benchmark)") {
    return 403;
}