The vulnerability allows authenticated users with low privileges to inject arbitrary SQL through the keyword parameter in the queries implemented by MyBatis. By using raw ${} substitution, attackers can craft payloads that are executed directly by the database, enabling data extraction from the application including data belonging to other tenants. The flaw supports classic techniques such as boolean logic, UNION selects, error-based, and time-based injections, providing a flexible attack surface for gathering sensitive information.

The flaw exists in the Dromara Skyeye application in the commit identified by 65d3ddcede70. Any release that incorporates this commit—whether as part of a distribution or a custom build—remains vulnerable until the issue is patched.

The CVSS score of 7.1 places this weakness in the high severity range. Exploitation requires legitimate authentication, but once authenticated, the attacker can target specific API endpoints such as queryWarehousingDetails and queryOutgoingDetails to perform the SQL injection. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, yet the combination of data exfiltration potential and privileged access makes the risk significant for organizations running the affected commit.