HortusFox web applications before version 6.2 allow an authenticated API token holder to inject arbitrary SQL through the include_info query parameter of the /api/locations/list endpoint. The vulnerability arises because PlantsModel::getSpecificInfo() concatenates the supplied value directly into the SELECT column list, enabling attackers to embed subqueries that can read any database table, including password hash storage. This flaw leads to a critical loss of data confidentiality, potentially exposing all user credentials and other sensitive information.

The affected product is HortusFox Web (hortusfox-web) developed by Daniel Brendel, with a known impact on all installations running any version prior to 6.2. The vulnerability is exposed via the public API endpoint /api/locations/list, which accepts an include_info parameter used in queries against the application's database.

The CVSS score of 7.1 reflects a high severity, primarily due to the confidentiality impact and the fact that the attack requires an API token that is usually shared only with trusted clients. The EPSS score is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog (KEV), suggesting no widespread exploitation is currently documented. Nevertheless, attackers who already have or can obtain API tokens can exploit this flaw internally, leading to the extraction of any database table without privilege escalation.