Description
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| JTL SW | JTL-WMS | < 2.0.7, < 2.1.3, < 2.2.1, 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.* | 2.0.7 |
References
- https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310 vendor-advisory