CVE-2026-78182

The SQL injection in PlanController.getImmediatePlans via the ORDER BY/SORT parameter is a vulnerability whose risk profile diverges significantly from what the CVSS 7.3 score suggests. The critical factor is context: this is a monitoring system handling environmental data that feeds into automated alert thresholds, compliance reporting, and potentially physical control responses. Standard SQL injection in a web application exposes a database; SQL injection here can expose the sensor data that automated systems trust for decision-making. Manipulated readings could falsify compliance records, disable legitimate alerts, or corrupt inputs to processes responding to environmental conditions. This blast radius extends far beyond data exfiltration — the CVSS score models information disclosure, not automated consequence. The ORDER BY injection vector persists across this class of software because most frameworks cannot parameterize column references — developers face a genuine friction between the legitimate requirement to let users sort by arbitrary columns and the secure implementation path, which typically requires whitelisting. This explains why the pattern recurs in monitoring and industrial software built from mid-2000s codebases. The typo in the CVE path (plamange vs planmanage) warrants direct verification in your deployment — the disclosure may describe one path while a sibling or parent endpoint contains the same vulnerability pattern. Verify whether this endpoint requires authentication and assess external exposure: pre-auth exploitation against an internet-facing monitoring API is a different risk tier than authenticated exploitation on a segmented internal system. For embedded or air-gapped deployments, recognize that the patch timeline may be measured in quarters rather than days, and compensating controls may be the realistic remediation path. Audit adjacent reporting endpoints in the same controller — rushed disclosures often correlate with incomplete fixes.

Reviewed through automated stages and approved by a human before publication.