Sparx Systems Enterprise Architect

Sparx Pro Cloud Server and Enterprise Architect: five CVEs including unauthenticated SQL execution and a WebEA race to code execution, public PoC, no vendor fix at disclosure

CERT Polska coordinated the disclosure of five vulnerabilities in Sparx Systems Pro Cloud Server (PCS) and Enterprise Architect (EA) on 2026-05-19, reported by Blazej Adamczyk (br0x) of Efigo (CERT Polska, 2026-05-19). CVE-2026-42097 lets an attacker omit the "model" query parameter and send the model name only in the POST request's binary blob, so PCS executes SQL queries without authentication, and CVE-2026-42096 lets any low-privileged user run arbitrary SQL queries in the database user context because permission checks are missing (CERT Polska, 2026-05-19). CVE-2026-42099 is a race condition in WebEA's /data_api/dl_internal_artifact.php: an attacker with repository access controls the name and contents of the file it writes, so a delayed response keeps a malicious PHP file reachable long enough for a second request to execute it; CVE-2026-42098 lets an authenticated EA user modify the client, for example with a debugger, to log in as any other user or administrator; and CVE-2026-42100 makes the PCS service terminate on a crafted SQL query (CERT Polska, 2026-05-19). The researcher scores the chain CVSS 4.0 10.0 because, with WebEA installed, the flaws give remote unauthenticated code execution in the web server context (sploit.tech, 2026-05-19); CCB lists CVSS 4.0 scores of 9.3 for CVE-2026-42097, 8.7 for CVE-2026-42096 and -42098, 7.7 for CVE-2026-42099 and 7.1 for CVE-2026-42100 (CCB, 2026-05-21). Proof-of-concept code exists for all five and no exploitation was known as of 2026-05-20: CCB's advisory title calls the flaws actively exploited, but its text reports no proof of exploitation as of that date (CCB, 2026-05-21); the published exploit script ships without the working key (GitHub br0xpl/sparx_hack), which sits in the freely downloadable EA client binary (sploit.tech, 2026-05-19). The vendor gave CERT Polska no details or vulnerable version range (CERT Polska, 2026-05-19) and had resolved none of the CVEs at disclosure (sploit.tech, 2026-05-19); Sparx's later Pro Cloud Server 6.5 release notes list WebEA security fixes, among them a corrected vulnerability when downloading internal artifacts and added validation of the model number parameter, without naming these CVEs (Sparx Systems).

Triage: a legitimate EA client names its model in the model query parameter of the request URL; a POST to the endpoint with no or a wrong model parameter is the bypass, which is why the researcher suggests a proxy that drops such requests (sploit.tech, 2026-05-19).