The vulnerability is a classic SQL injection (CWE‑89) that allows an attacker to inject arbitrary SQL through the order_by and group_by fields of the /api/data/invoke endpoint. By using subqueries, EXTRACTVALUE, or UPDATEXML functions the attacker can bypass the SqlGuard denylist and row‑level security to read or even modify data belonging to other users or tables that should be protected.

The flaw affects the Kuafuai AipexBase platform in all releases prior to commit 690adb9. Any installation that has not applied this specific commit or a later patch is vulnerable.

The CVSS score of 7.1 reflects a moderate to high impact, but no EPSS data is available and the issue is not listed in CISA’s KEV catalog. The attack can be carried out by sending a crafted request to the /api/data/invoke endpoint, so exposure depends on the endpoint’s accessibility and authentication controls. If the API is reachable from an attacker’s network, the risk of data leakage or unauthorized modification exists.