CVE-2026-75132 in WAPT
Summary
by MITRE • 08/31/2026
WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point, an attacker can inject additional PostgreSQL statements, bypass the host scope restrictions applied to the account, and read information from other rows or tables within the database.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in WAPT Server versions 2.6.1.17834 and earlier represents a critical security flaw rooted in improper input validation and sanitization of user-supplied data. Specifically, this issue affects the GET /api/v3/hosts endpoint, where the columns parameter is directly concatenated into SQL queries without adequate protection against injection attacks. This architectural weakness allows for significant unauthorized access to sensitive database information, even when the attacker operates under restricted permissions. The presence of such a flaw indicates that the application fails to enforce strict separation between code and data during query construction, a fundamental principle required to prevent structured query language manipulation.
From a technical perspective, this vulnerability is classified as SQL Injection, corresponding to CWE-89 in the Common Weakness Enumeration taxonomy. The core issue lies in how the backend processes the columns parameter sent via HTTP GET requests. Instead of using prepared statements or parameterized queries that safely bind input values to query placeholders, the application appears to interpolate user input directly into the dynamic SQL string. This allows an authenticated attacker with read-only privileges to manipulate the structure of the executed database command. By injecting specific PostgreSQL expressions, the attacker can alter the logic of the original query intended by the system administrators or developers.
The operational impact of this vulnerability extends far beyond simple data exfiltration from targeted rows. Because WAPT is designed to manage IT infrastructure and host configurations, its underlying database contains highly sensitive information regarding network topology, software inventories, security policies, and potentially credential hashes or configuration secrets associated with managed endpoints. An attacker exploiting this flaw can bypass the intended scope restrictions of their read-only account. This means that while a standard user might only be allowed to view details about specific hosts they are authorized to manage, an exploited injection allows them to query arbitrary tables across the entire database schema. Consequently, attackers can retrieve data belonging to other users or administrative accounts, effectively elevating their privileges through information disclosure rather than direct authentication bypass.
This type of attack aligns with several tactics within the MITRE ATT&CK framework, particularly those related to Collection and Credential Access. The ability to read arbitrary rows and tables facilitates reconnaissance and discovery phases where attackers map out the database structure before proceeding to more destructive actions such as data exfiltration or further privilege escalation. In some scenarios, depending on the specific PostgreSQL configuration and backend capabilities exploited through stacked queries, this could potentially lead to remote code execution if functions like pg_read_file are accessible, although the primary documented impact here is unauthorized data access. The severity is heightened by the fact that authentication is required but only basic read-only privileges are needed, making it a low-barrier entry point for insider threats or compromised accounts with minimal permissions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. For organizations currently running affected versions of WAPT Server, upgrading to version 2.6.1.17835 or later is the primary recommended action, as this release includes patches for the identified SQL injection vulnerability in the columns parameter. Until an upgrade can be performed, network-level controls such as Web Application Firewalls may help detect and block common SQL injection patterns targeting the /api/v3/hosts endpoint, though these are not foolproof defenses against sophisticated attackers who can obfuscate their payloads. From a development standpoint, implementing strict input validation that rejects any non-alphanumeric characters in parameters expected to be column names is essential. Furthermore, adopting parameterized queries or object-relational mapping tools that automatically handle escaping and type safety will prevent similar vulnerabilities from recurring in other parts of the application. Regular security audits focusing on dynamic SQL construction practices are also advised to ensure compliance with secure coding standards like OWASP Top Ten guidelines regarding injection flaws.