Executive brief
Super-Diamond is a configuration management server used to store and retrieve application settings across environments. An attacker with a valid login session can inject malicious SQL code through the preview endpoint to extract sensitive data, including database contents, version information, and administrator password hashes. This allows unauthorized access to all managed configurations and potential lateral movement within the organization.
Technical details
The vulnerability is a SQL injection in the /superdiamond/preview/{projectCode}/{module}/{type} endpoint, where the module parameter is directly concatenated into a SQL IN clause via StringUtils.split() without parameterization or binding. The application includes a SqlInjectionUtil with regex-based blacklist filtering, but this code path does not invoke it. An attacker with valid authentication credentials can inject UNION SELECT statements or OR 1=1 bypass clauses to extract arbitrary database content, including H2 database versions and administrator password hashes. The vulnerability requires a valid login session (or bypass with default credentials admin/000000), but the network is reachable via HTTP.
Affected products
- super-diamond super-diamond-server <= 1.3.3
Timeline
- 2026-08-26: disclosed