{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-8734/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-8734"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pamirs (\u003c= 7.2.0)"],"_cs_severities":["high"],"_cs_tags":["sql injection","cve-2026-8734","web application"],"_cs_type":"advisory","_cs_vendors":["Oinone"],"content_html":"\u003cp\u003eOinone Pamirs, up to version 7.2.0, is susceptible to SQL injection (CVE-2026-8734) within the \u003ccode\u003eRSQLToSQLNodeConnector.makeVariable\u003c/code\u003e function of the \u003ccode\u003equeryListByWrapper\u003c/code\u003e interface. This vulnerability enables a remote attacker to inject and execute arbitrary SQL commands by manipulating input to this function.  The vulnerability has a CVSS v3.1 base score of 7.3, indicating a high severity. Public exploits targeting this flaw have been disclosed, increasing the risk of exploitation. The vendor was notified of the vulnerability but did not respond.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an Oinone Pamirs instance running a version equal to or below 7.2.0 with the vulnerable \u003ccode\u003equeryListByWrapper\u003c/code\u003e interface exposed.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting the \u003ccode\u003equeryListByWrapper\u003c/code\u003e interface.\u003c/li\u003e\n\u003cli\u003eThe request includes specially crafted input designed to inject SQL commands into the \u003ccode\u003eRSQLToSQLNodeConnector.makeVariable\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe application processes the malicious input without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe injected SQL commands are executed against the underlying database.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to sensitive data stored in the database.\u003c/li\u003e\n\u003cli\u003eThe attacker may modify or delete data, potentially leading to data corruption or denial of service.\u003c/li\u003e\n\u003cli\u003eThe attacker could potentially use the database as a pivot point to compromise other systems on the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SQL injection vulnerability (CVE-2026-8734) can lead to unauthorized access to sensitive information, data manipulation, and potential compromise of the underlying database server. Given the presence of publicly available exploits, organizations using vulnerable versions of Oinone Pamirs are at significant risk. The impact could range from data breaches and financial loss to reputational damage and disruption of services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply appropriate input validation and sanitization techniques to mitigate SQL injection vulnerabilities, referencing CWE-89.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect CVE-2026-8734 Exploitation — SQL Injection in Oinone Pamirs\u003c/code\u003e to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests targeting the \u003ccode\u003equeryListByWrapper\u003c/code\u003e interface (logsource: webserver).\u003c/li\u003e\n\u003cli\u003eReview and restrict database access privileges to minimize the impact of potential SQL injection attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-17T06:16:51Z","date_published":"2026-05-17T06:16:51Z","id":"https://feed.craftedsignal.io/briefs/2026-05-oinone-pamirs-sqli/","summary":"Oinone Pamirs up to version 7.2.0 is vulnerable to SQL injection in the RSQLToSQLNodeConnector.makeVariable function of the queryListByWrapper Interface, allowing remote attackers to execute arbitrary SQL commands.","title":"Oinone Pamirs SQL Injection Vulnerability (CVE-2026-8734)","url":"https://feed.craftedsignal.io/briefs/2026-05-oinone-pamirs-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed — Cve-2026-8734","version":"https://jsonfeed.org/version/1.1"}