CVE-2026-7486: SQLi in Netcad's E-İmar

Synopsis

A SQL injection vulnerability affects Netcad Software Inc.'s E-İmar application, versions 2.10.1.0 through before 3.0.2. The flaw is reachable over the network without any authentication, meaning an attacker can send crafted HTTP requests directly to the application. Successful exploitation gives the attacker full read, write, and denial-of-service capabilities over the underlying database. A patched-image rebuild at version 3.0.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The application is exposed over the network, so an attacker must be able to reach the service via HTTP or HTTPS to deliver a malicious SQL payload.

• AuthenticationNot required

  No account or session token is needed; the vulnerable endpoint accepts and processes unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental pre-configuration.

Blast Radius

• An attacker can read all data stored in the database, including user credentials, session tokens, and any application records managed by E-İmar.
• An attacker can insert, update, or delete database rows, corrupting planning records or injecting malicious data into the application.
• An attacker can crash or hang the database service by issuing resource-exhausting queries, taking the E-İmar application offline.
• Depending on database server configuration, an attacker may escalate to operating-system command execution via database-native file or shell features.