Technical impact
The vulnerability allows an attacker to inject arbitrary SQL statements by manipulating the arguments passed to the orderItem.getColumn method in the SqlFilterArgumentResolver class of pig-mesh. This flaw can lead to unauthorized data exposure, modification, or deletion, which compromises the confidentiality, integrity, and availability of the database. The exploitation does not require authentication and can be performed over the network, enabling remote attackers to execute malicious queries. The vulnerability is classified as a moderate severity issue with a CVSS score of 5.3. It has a publicly available exploit and is considered exploitable by attackers with network access to the targeted service.
Affected Systems
Pig‑Mesh products running pig version 4.1.0 or earlier are affected. The problem resides in the orderItem.getColumn function within the pig‑common‑data module. Updating to pig version 4.1.1 or later includes a fix that blocks the untrusted input thereby mitigating the injection risk. No other vendor or product versions are listed as impacted.
Risk and Exploitability
The vulnerability is present in all releases prior to 4.1.1, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data are not available, so the exact probability of exploitation cannot be quantified, but the presence of a public exploit and the remote nature of the attack vector increase the practical risk. The CVSS score of 5.3 indicates a medium risk, yet the potential impact on database integrity and confidentiality is significant. Attackers can inject arbitrary SQL by supplying malicious column names through the application’s input mechanism, which is typically exposed via HTTP requests or API calls. Defensive mitigation therefore relies on eliminating the vulnerable code path and ensuring proper input validation.
