SQL Injection in Helical Insight via /executeDatasource

Helical Insight through version 7.0.0 contains a critical SQL injection vulnerability (CVE-2026-111634) within its report parameter processing mechanism. The flaw resides in the /executeDatasource endpoint, where the application fails to properly sanitize Numeric and String placeholder values. Because the internal SqlDetect filter fails to correctly validate these inputs, an authenticated user can inject arbitrary SQL commands. This vulnerability allows an attacker to bypass existing security controls to perform unauthorized operations, including reading sensitive data from tables that should be restricted or modifying existing records within the report's backend data source. With a CVSS score of 8.1, this flaw presents a significant risk for environments where report viewers have access to sensitive analytical databases.

Impact

Successful exploitation allows authenticated attackers to gain unauthorized access to backend database content, potentially leading to data exfiltration or integrity loss. The scope of impact is limited to the data sources accessible by the Helical Insight application, but in enterprise environments, this often includes broad access to business intelligence repositories.

Recommendation

• Upgrade Helical Insight to a version beyond 7.0.0 immediately upon release of a security patch.
• Review access logs for the /executeDatasource endpoint to identify unusual parameter payloads containing common SQL injection syntax (e.g., symbols such as single quotes, double dashes, or UNION/SELECT keywords).
• Implement strict input validation at the Web Application Firewall (WAF) layer for all requests directed to /executeDatasource to block malicious SQL patterns.
• Audit database permissions for the service account utilized by Helical Insight to ensure it adheres to the principle of least privilege, preventing full database compromise in the event of an injection.