A vulnerability exists in the Alixhan xh-admin-backend component that allows an attacker to manipulate the request argument sent to the /frontend-api/system-service/api/system/role/query endpoint. This manipulation leads to unparameterized SQL queries, enabling an attacker to execute arbitrary SQL statements. The primary impact of exploiting this flaw is unauthorized data exposure, potential data modification, and possible privilege escalation if the database user has elevated rights. The weakness is classified under CWE-74 and CWE-89, indicating raw data usage in a database query without proper sanitization.

The affected product is Alixhan xh-admin-backend version 1.7.0 and prior releases. Users running any version up to 1.7.0 should consider themselves at risk, as the flaw resides in the Database Query Handler processing component.

The CVSS score of 5.3 denotes medium severity, and the EPSS score indicates a very low likelihood of automated exploitation at the current report time, though the vulnerability has been publicly disclosed. Attackers can launch the exploit remotely by sending crafted HTTP requests to the vulnerable endpoint; no local prerequisites are documented. The vulnerability is not listed in the CISA KEV catalog, but the public disclosure suggests it is actively known in the community.