Description

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T23:17:18.533Z",
  "pubdate": "2026-08-26T23:17:18.533Z",
  "executiveSummary": "The super-diamond-server platform, specifically versions 1.3.3 and earlier, contains a critical SQL injection vulnerability within the /superdiamond/preview/{projectCode}/{module}/{type} endpoint.\nThis vulnerability is classified as a SQL injection flaw, arising from the insecure handling of user-supplied input.\nSuccessful exploitation allows an unauthenticated or authenticated attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exposure, data modification, or complete compromise of the database management system.\nThe risk is categorized as high, as the lack of input sanitization and parameterization in the SQL query construction permits the manipulation of query logic.\nAttackers can leverage this capability to bypass authentication, extract sensitive system information, or perform destructive operations, posing a significant risk to the integrity and confidentiality of the affected infrastructure.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure implementation of query construction within the /superdiamond/preview/{projectCode}/{module}/{type} endpoint. The application processes the 'module' path parameter by passing it directly into a backend database operation.\nSpecifically, the application utilizes StringUtils.split() to process the 'module' string and subsequently embeds the results directly into a SQL 'IN' clause through string concatenation. This process fails to utilize prepared statements or parameterized queries, which are essential security controls for neutralizing SQL injection threats.\nBecause the 'module' parameter is treated as trusted input, an attacker can supply specially crafted SQL syntax within the URL path. By injecting malicious characters such as single quotes, comments, or logical operators (e.g., OR 1=1), the attacker can alter the intended structure of the SQL query executed by the database engine.\nThe attack flow proceeds as follows: 1) The attacker identifies the vulnerable endpoint exposed on the network. 2) The attacker crafts a request to the /superdiamond/preview/ endpoint, replacing the legitimate 'module' segment with an injection payload designed to escape the 'IN' clause. 3) The application server receives the request and triggers the vulnerable logic, concatenating the malicious payload into the raw SQL query. 4) The database engine executes the modified query, returning unintended data or performing unauthorized database operations based on the payload.\nSince the parameter is processed before any meaningful validation or escaping, the vulnerability is highly susceptible to automated exploitation tools. The lack of parameterized query binding effectively grants the attacker control over the query execution context. The impact of such exploitation extends to complete database compromise, potentially allowing an attacker to exfiltrate table contents, schema information, or administrative credentials stored within the database.\nThe vulnerability affects all super-diamond-server installations up to and including version 1.3.3. There is no evidence that the application employs an object-relational mapping (ORM) layer that would automatically mitigate this issue; the manual string concatenation indicates a direct, unsafe interaction with the database driver."
}