A weakness in Grit42’s GritEntityController allows an attacker to inject and execute arbitrary SQL statements by manipulating input sent to the CSV export endpoint. The vulnerability is rooted in unsanitized data handling, corresponding to CWE‑74 and CWE‑89. Successful exploitation would grant the attacker unauthorized access to the underlying database, enabling data exfiltration, tampering, or privilege escalation within the application. The description indicates that the attack can be started remotely, implying that the goal can be achieved over the network without local access.

Versions of Grit up to and including 0.11.0 are affected. In particular, any installation using the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb in those releases is vulnerable. The vulnerability is specific to the Grit42 product line and does not affect other vendors or components.

The CVSS score of 5.3 categorizes this flaw as moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation may not yet be occurring. However, because the exploit can be triggered remotely via a public endpoint and the code is publicly disclosed, the risk remains significant. Attackers need only to craft a malicious request against the CSV export functionality; no additional privilege escalation steps are required beyond the application context.