Executive brief
Wgcloud, a server monitoring and management suite, contains a security flaw that could allow an attacker to manipulate database queries. By sending specially crafted requests to the monitoring interface, a remote attacker can gain unauthorized access to the underlying database. This could lead to the theft of sensitive monitoring data or the escalation of privileges within the application, potentially granting the attacker full administrative control over the monitoring system.
Technical details
A SQL injection vulnerability exists in Wgcloud v3.6.4 within the /portInfo/list endpoint. The root cause is the improper sanitization of the 'orderType' argument in the MyBatis mapping file 'PortInfoMapper.xml'. A remote attacker can exploit this by supplying malicious SQL commands through the affected parameter to bypass intended query logic. Successful exploitation allows the attacker to gain unauthorized database access, potentially achieving Database Administrator (DBA) privileges and full control over the application's data layer.
Affected products
- Wgcloud Wgcloud 3.6.4
Timeline
- 2026-07-21: disclosed: Initial vulnerability report published
- 2026-07-21: advisory: NVD entry created