CVE-2026-84859 in ScadaLTS
Summary
by MITRE • 09/16/2026
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection
The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.
The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
ScadaLTS version 2.8.1-release-candidate build 0 contains a critical security vulnerability classified as an Authenticated Blind SQL Injection within its web application interface. This flaw resides specifically in the API endpoint located at /api/events/search, which is designed to handle search queries for system events via HTTP POST requests. The vulnerability stems from improper input validation and sanitization practices during the processing of user-supplied data. Specifically, the endpoint accepts a JSON body that includes a sortBy array intended to define the sorting criteria for the returned event records. Instead of using parameterized queries or prepared statements to safely incorporate these values into the database query structure, the application directly concatenates the contents of this array into an SQL ORDER BY clause. This architectural decision bypasses standard defense-in-depth mechanisms provided by modern database drivers and leaves the underlying data layer exposed to malicious manipulation by any user who can successfully authenticate to the system.
The operational impact of this vulnerability is severe due to its blind nature, which requires attackers to infer information through indirect means rather than receiving direct error messages or result sets in response payloads. An authenticated attacker possessing at least the ROLE_USER privilege level can exploit this flaw using time-based and boolean-based techniques. In a time-based attack, the adversary injects SQL commands that cause deliberate delays in database execution, allowing them to deduce data character by character based on response latency. Alternatively, boolean-based injection involves injecting conditions that alter the logical outcome of queries, enabling the extraction of information through variations in application behavior or content length. Because this vulnerability affects the sorting mechanism used for event retrieval, it provides a reliable vector for extracting sensitive database contents without triggering obvious system errors that might alert security monitoring tools.
The scope of data exfiltration enabled by this flaw is extensive and poses significant risks to organizational integrity and user privacy. Attackers can leverage the injection point to query arbitrary tables within the backend database schema. Of particular concern is the ability to extract password hashes for all users stored in the system. Since these hashes are often used as a primary credential store, their compromise allows attackers to perform offline brute-force or rainbow table attacks to recover plaintext passwords. This capability effectively grants unauthorized access not only to the compromised account but potentially to other accounts if credentials have been reused across different systems or services. The extraction of such sensitive data violates core principles of confidentiality and integrity defined in information security frameworks, leading to potential regulatory non-compliance depending on the industry sector involved.
From a classification perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific technique employed falls under blind injection methods where direct output is not available to the attacker. In terms of offensive security tactics, this exploitation maps directly to MITRE ATT&CK Technique T1059.004, which covers Command and Scripting Interpreter: SQL Commands. This mapping highlights how attackers use standard database query languages as a vehicle for executing malicious logic within trusted applications. The fact that the endpoint is accessible via POST requests defined in spring-security.xml indicates that while authentication is required, the authorization model fails to restrict this specific functionality based on the sensitivity of the data being accessed or the potential impact of modifying sort parameters.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective technical fix involves refactoring the backend code responsible for handling the /api/events/search endpoint to utilize parameterized queries or prepared statements exclusively, ensuring that user input is never directly concatenated into SQL commands regardless of context. If dynamic sorting based on user input is a required feature, developers should implement an allowlist approach where only predefined column names and sort directions are permitted, validating incoming values against this list before constructing the query string. Additionally, implementing Web Application Firewall rules can provide temporary protection by detecting common SQL injection patterns in JSON payloads targeting this endpoint. On the administrative side, enforcing strict role-based access control to limit who can invoke search functions with complex sorting parameters may reduce the attack surface until patches are deployed. Regular security code reviews and static application security testing should be integrated into the development lifecycle to prevent similar flaws from being introduced in future releases of ScadaLTS or related industrial control system software.