An improper neutralization of special elements in the apr_dbd_oracle provider allows an attacker to inject arbitrary SQL statements, leading to unauthorized data exfiltration, modification, or potential denial of service. The vulnerability is a classic input validation flaw classified as CWE-89, where crafted values bypass proper escaping when building SQL commands.

Apache Portable Runtime Utility, versions 1.6.0 through 1.6.3, supplied by the Apache Software Foundation.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so official exploitation data is lacking. However, the CVSS score of 9.1 indicates a high severity. Because the flaw resides in the database access layer, any application that loads the apr_dbd_oracle provider could be exploited. The likely attack vector is by sending specially crafted inputs to the affected application; based on the description it is inferred that the attacker would need to influence the query construction path of the application. The consequence could range from data compromise to full database compromise if the attacker can execute arbitrary SQL.