CVE-2026-81815

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.08

Description An issue exists in the entity engine's generic performFind service on deployments using MySQL or MariaDB. A remote unauthenticated attacker can disclose arbitrary rows from a queried entity by submitting a crafted ignore-case find request (e.g., ic=Y). This occurs because the SqlJdbcUtil.addValueSingle() function inlines the EntityFunction-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter. Since MySQL and MariaDB honor backslash escapes, a backslash-terminated payload can break out of the string literal and transform the WHERE clause into a tautology, which is a statement that is always true.

Recommendations Upgrade to version 24.09.08.