CVE-2026-7672 — Youlaitech Youlai-Boot SQL Injection

title: CVE-2026-7672: Youlaitech Youlai-Boot SQL Injection in getUserList
id: scw-2026-05-03-ai-1
status: experimental
level: high
description: |
  Detects exploitation attempts against CVE-2026-7672 in Youlaitech Youlai-Boot. This rule specifically looks for requests to the '/api/user/list' endpoint with a manipulated 'order' parameter that attempts to inject SQL commands, such as 'order=null union select' or 'order=null,', indicating a potential SQL injection vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-03
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7672/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri: 
          - '/api/user/list'
      cs-method: 
          - 'GET'
      cs-uri-query|contains:
          - 'order=null%20union%20select'
          - 'order=null%20UNION%20SELECT'
          - 'order=null%2c'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse