# CVE-2026-115997 - pig4cloud (pig-mesh/pig) <= 4.1.0 SQL injection via the MyBatis-Plus
# sort resolver (SqlFilterArgumentResolver.getColumn): the ascs/descs request parameters are
# concatenated into an ORDER BY clause guarded only by a regex blacklist, so an authenticated
# low-privilege user can inject error-/time-based SQL. Matches injection payloads carried in
# the ascs/descs query parameter on any paginated endpoint.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-115997 pig4cloud - SQL Injection via MyBatis-Plus Sort Parameter ascs/descs"; flow:established,to_server; http.uri; content:"scs="; nocase; fast_pattern; pcre:"/[?&](?:a|de)scs=[^&]{0,300}(?:extractvalue|updatexml|benchmark|sleep(?:\x28|%28)|union(?:\x20|\x2b|%20)+?select|procedure\x20analyse)/i"; classtype:web-application-attack; reference:cve,CVE-2026-115997; reference:url,https://www.exploit.observer/?keyword=CVE-2026-115997&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=pig4cloud&match=exact; sid:1090400; rev:1;)