An authenticated user can inject malicious SQL statements through the HistoryReadRequest parameters of the JSON‑SCADA opcApi endpoint. Parameters such as NodeId.Id, StartTime and EndTime are concatenated into a query without proper sanitization, allowing the attacker to execute stacked statements. This flaw lets the attacker read, modify, or delete historian data anywhere in the system, effectively bypassing role‑based access controls for that data.

JSON‑SCADA versions released before 0.65‑alpha from vendor riclolsen are affected. All installations of these earlier releases that expose the HistoryRead API to authenticated users are vulnerable.

The CVSS base score of 8.7 indicates a high impact. Since exploitation requires authentication, the attack vector is primarily internal or through compromised credentials, and the vulnerability permits straightforward modification of critical data. No known public exploits or KEV listing are available at this time, but the flaw remains highly actionable for an attacker who has logged into the system.