CVE-2026-110614 in citrus
Summary
by MITRE • 10/14/2026
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Yiuman citrus, specifically affecting versions up through 0.15.0, represents a critical security flaw within its generic query framework known as citrus-support. This component is designed to streamline data retrieval operations by allowing developers to define common querying patterns without writing repetitive SQL code for every endpoint. However, the implementation fails to adequately sanitize or validate user-supplied input when constructing dynamic SQL statements, particularly regarding sorting mechanisms. The root cause lies in how the sortBy request parameter is processed; instead of mapping this value against a predefined whitelist of allowed column names, the framework directly interpolates the user-provided string into the ORDER BY clause of the underlying database query. This architectural decision creates a direct path for attackers to manipulate the structure and execution context of SQL commands issued by the application backend.
From an operational perspective, this flaw allows any authenticated or unauthenticated user, depending on the specific controller configuration, to inject arbitrary SQL code via the sortBy parameter when accessing generic list routes exposed by controllers that extend BaseQueryController or BaseQueryRestful. Because these base classes are commonly used for standard CRUD operations in many applications built with Yiuman citrus, a significant number of endpoints may be susceptible if they rely on this sorting functionality without additional validation layers. The attacker can append malicious SQL fragments to the ORDER BY clause, effectively bypassing intended data access controls and logic constraints inherent in the application layer. This lack of input validation is classified under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL Injection.
The exploitation potential of this vulnerability is substantial due to its impact on data confidentiality and integrity. Attackers can leverage boolean-based or time-based blind techniques to extract sensitive database contents incrementally. In a boolean-based attack, the adversary modifies the sortBy parameter to include conditional logic that alters the application's response based on whether a specific SQL condition evaluates to true or false. By observing these differences in HTTP responses, such as status codes or content length variations, an attacker can deduce information about the database schema and stored data bit by bit. Alternatively, time-based blind injection involves appending commands like SLEEP() or WAITFOR DELAY that cause the database server to pause execution for a specified duration if certain conditions are met. This allows attackers to infer data presence based on response latency, even when direct output from SQL queries is not displayed in the application interface.
This type of exploitation aligns with techniques documented in the MITRE ATT&CK framework, specifically under T1059 Command and Scripting Interpreter for executing database commands via injection points, and more precisely relates to data exfiltration methods where structured query language manipulation is used to retrieve unauthorized information. The ability to extract arbitrary data means that sensitive user credentials, personal identifiable information, financial records, or proprietary business logic stored in the backend database could be compromised. Furthermore, depending on the privileges of the database account running the application, an attacker might escalate their access to perform destructive actions such as modifying existing records or dropping tables, although this is less common with ORDER BY injection compared to UNION-based attacks that allow direct result set retrieval.
To mitigate this vulnerability, developers must implement strict input validation for all parameters used in dynamic SQL construction. The most effective remediation strategy involves replacing the direct interpolation of user-supplied values into the sortBy parameter with a whitelist approach. This means maintaining a list of allowed column names and validating the incoming request against this list before constructing the query. If sorting by arbitrary columns is not required, it should be disabled entirely for public-facing endpoints. Additionally, employing parameterized queries or prepared statements where feasible can help isolate data from code, although in the specific context of ORDER BY clauses which often require dynamic column names rather than values, whitelisting remains the primary defense. Upgrading to a patched version of Yiuman citrus that addresses this flaw is essential for existing deployments. Security teams should also conduct thorough penetration testing focusing on query parameter manipulation and monitor logs for unusual patterns indicative of blind SQL injection attempts, such as repeated requests with varying sortBy parameters resulting in delayed responses or error-based feedback.