{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/helical-insight/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:helicalinsight:helical_insight:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-111634"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Helical Insight (\u003c= 7.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Helical Insight"],"content_html":"\u003cp\u003eHelical Insight through version 7.0.0 contains a critical SQL injection vulnerability (CVE-2026-111634) within its report parameter processing mechanism. The flaw resides in the /executeDatasource endpoint, where the application fails to properly sanitize Numeric and String placeholder values. Because the internal SqlDetect filter fails to correctly validate these inputs, an authenticated user can inject arbitrary SQL commands. This vulnerability allows an attacker to bypass existing security controls to perform unauthorized operations, including reading sensitive data from tables that should be restricted or modifying existing records within the report's backend data source. With a CVSS score of 8.1, this flaw presents a significant risk for environments where report viewers have access to sensitive analytical databases.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to gain unauthorized access to backend database content, potentially leading to data exfiltration or integrity loss. The scope of impact is limited to the data sources accessible by the Helical Insight application, but in enterprise environments, this often includes broad access to business intelligence repositories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Helical Insight to a version beyond 7.0.0 immediately upon release of a security patch.\u003c/li\u003e\n\u003cli\u003eReview access logs for the /executeDatasource endpoint to identify unusual parameter payloads containing common SQL injection syntax (e.g., symbols such as single quotes, double dashes, or UNION/SELECT keywords).\u003c/li\u003e\n\u003cli\u003eImplement strict input validation at the Web Application Firewall (WAF) layer for all requests directed to /executeDatasource to block malicious SQL patterns.\u003c/li\u003e\n\u003cli\u003eAudit database permissions for the service account utilized by Helical Insight to ensure it adheres to the principle of least privilege, preventing full database compromise in the event of an injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:47:19Z","date_published":"2026-10-16T18:47:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-helical-insight-sql-injection/","summary":"Helical Insight versions through 7.0.0 contain an authenticated SQL injection vulnerability in the /executeDatasource endpoint that allows attackers to manipulate backend database queries.","title":"SQL Injection in Helical Insight via /executeDatasource","url":"https://feed.craftedsignal.io/briefs/2026-10-helical-insight-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Helical Insight","version":"https://jsonfeed.org/version/1.1"}