high advisory March 30, 2026

YunaiV yudao-cloud SQL Injection Vulnerability

A remote SQL injection vulnerability (CVE-2026-5147) exists in YunaiV yudao-cloud up to version 2026.01 via the Website argument in the /admin-api/system/tenant/get-by-website endpoint, allowing unauthenticated attackers to potentially execute arbitrary SQL queries.

A security flaw, identified as CVE-2026-5147, has been discovered in YunaiV yudao-cloud software, specifically versions up to 2026.01. The vulnerability resides in the /admin-api/system/tenant/get-by-website endpoint, where manipulation of the Website argument can lead to SQL injection. This allows for potential remote exploitation without requiring authentication. The vulnerability was reported to the vendor, but no response or patch has been provided. Publicly available exploit code…

Detection coverage 2

Detect SQL Injection Attempts in yudao-cloud Website Parameter

high

Detects potential SQL injection attempts targeting the Website parameter in the /admin-api/system/tenant/get-by-website endpoint.

sigma tactics: initial_access techniques: T1190 sources: webserver, linux

Detect Suspicious Database Queries from yudao-cloud

medium

Detects suspicious database queries originating from the yudao-cloud application, potentially indicating SQL injection exploitation.

sigma tactics: initial_access techniques: T1190 sources: database, mysql

Detection queries are kept inside the platform. Get full rules →