CVE-2026-75876 in EasyReport
Summary
by MITRE • 08/18/2026
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in xianrendzw EasyReport versions up to 2.0.17.0522_Beta represents a critical security flaw within the application's move operations functionality, specifically located in the ModuleController.java component. This issue stems from improper neutralization of special elements used in an SQL command, commonly known as SQL injection. The root cause lies in how the software handles user-supplied input for the sourcePath argument without adequate validation or sanitization mechanisms. When a remote attacker provides maliciously crafted data through this parameter, the application fails to distinguish between executable code and valid database queries, allowing the injected payload to be interpreted by the underlying database engine as part of the SQL statement rather than mere data.
From an operational perspective, this vulnerability allows for unauthenticated or authenticated remote exploitation depending on the specific access controls surrounding the move operations feature. Because the exploit has been disclosed publicly, automated scanning tools and malicious actors can readily leverage known techniques to target systems running affected versions. The primary impact of a successful SQL injection attack in this context includes unauthorized access to sensitive data stored within the application's database, such as user credentials, configuration details, or proprietary business information. Furthermore, depending on the privileges granted to the database account used by the web application, an attacker may execute administrative operations on the database server, potentially leading to complete system compromise, data modification, or deletion of critical records.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command. In terms of offensive security frameworks, this flaw facilitates techniques categorized under ATT&CK ID T1059, specifically command scripting via database commands, and potentially T1078 if the attacker uses compromised credentials to access the vulnerable endpoint. The lack of response from the project maintainers despite early notification exacerbates the risk landscape, leaving users without official patches or guidance on remediation timelines.
To mitigate this vulnerability in environments where immediate patching is not feasible, administrators should implement strict input validation and parameterized queries within the application codebase to ensure that user inputs are treated strictly as data rather than executable commands. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by filtering out malicious SQL patterns before they reach the vulnerable controller method. Users are strongly advised to upgrade to a patched version once available or restrict network access to the affected module if it is not essential for public-facing operations until a permanent fix is released.