Description

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point, an attacker can inject additional PostgreSQL statements, bypass the host scope restrictions applied to the account, and read information from other rows or tables within the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T16:19:11.070Z",
  "pubdate": "2026-08-31T16:19:11.070Z",
  "executiveSummary": "WAPT Server versions 2.6.1.17834 and earlier are susceptible to a critical SQL injection vulnerability residing within the /api/v3/hosts endpoint.\nThe vulnerability originates from improper neutralization of user-supplied input provided to the 'columns' parameter, which is directly concatenated into a PostgreSQL query.\nA remote attacker authenticated with read-only privileges can manipulate this parameter to execute arbitrary PostgreSQL expressions, effectively bypassing predefined host scope restrictions.\nSuccessful exploitation allows unauthorized access to sensitive data stored within the database, including information outside the intended scope of the authenticated user's account.\nThis flaw presents a significant security risk, as it facilitates unauthorized data exfiltration and potential compromise of database integrity by leveraging the application's own service account permissions.\nExploitation requires a valid, authenticated session, emphasizing the risks associated with internal or compromised low-privileged accounts within the WAPT environment.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located within the WAPT Server API architecture, specifically affecting the GET /api/v3/hosts endpoint.\nThe root cause is the insecure handling of the 'columns' parameter, where user-supplied data is concatenated directly into the backend PostgreSQL statement without sufficient parameterization or escaping. This allows an attacker to break out of the intended query structure.\nAn authenticated user with read-only access can manipulate the 'columns' parameter to terminate the original query and append malicious SQL statements using standard PostgreSQL syntax, such as UNION operators or stacked queries if the database driver supports it.\nThe attack flow commences when a user sends a crafted GET request to /api/v3/hosts, injecting PostgreSQL commands into the 'columns' field. The application server processes this request and executes the modified query against the database backend.\nBecause the query is executed with the privileges of the database user configured for the WAPT Server, the attacker can circumvent the application's internal logical controls, specifically the host scope restrictions designed to limit what a read-only account can retrieve.\nBy bypassing these restrictions, an attacker can perform unauthorized database lookups, query unauthorized tables, or extract sensitive system configurations and host information that should have been restricted based on the user's role.\nThe scope of impact is limited to the database layer; however, given the sensitive nature of information handled by WAPT Servers, this enables significant data harvesting. The vulnerability is present in versions up to and including 2.6.1.17834, representing a failure in input validation and query construction best practices within the API design."
}