---
id: CVE-2026-111718
title: AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
summary: >-
  AipexBase through commit 690adb9 contains a sql injection vulnerability that
  allows attackers to inject SQL through the order_by and group_by fields of the
  /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and
  UP…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: kuafuai
product: aipexbase
affected:
  - aipexbase <= 690adb933e72b1ead911badd52caa6d1f71046cd
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:56:18.838230Z'
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:56:23.952Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111718'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/aipexbase-dynamic-data-order-by-group-by-sql-injection
  - url: >-
      https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/OrderByBuilder.java#L24-L67
  - url: >-
      https://github.com/kuafuai/aipexbase/blob/690adb933e72b1ead911badd52caa6d1f71046cd/backend/src/main/java/com/kuafuai/dynamic/condition/GroupByBuilder.java#L22-L33
  - url: >-
      https://www.vulncheck.com/advisories/aipexbase-through-commit-690adb9-sql-injection-via-api-data-invoke
    label: >-
      VulnCheck Advisory: AipexBase through commit 690adb9 SQL Injection via
      /api/data/invoke
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-16T18:43:08.638Z'
---

## Overview

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.

## Affected

- `aipexbase <= 690adb933e72b1ead911badd52caa6d1f71046cd`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.