A flaw in MixPHP Framework 2.x through 2.2.17 allows an attacker to inject arbitrary SQL commands via a crafted data array passed to the data function in BuildHelper.php. This weakness, identified as CWE‑89, can enable unauthorized database access, data theft or modification, and potentially compromise system integrity. The description indicates that injection occurs when the application constructs SQL queries without proper sanitization, meaning successful exploitation could lead to privileged information disclosure or data tampering.

MixPHP Framework versions 2.0 through 2.2.17 are affected. The vulnerability is present in the BuildHelper.php file that handles database query construction based on user-supplied data arrays.

The vulnerability has a CVSS score of 6.5 and no EPSS score is available, but its nature as a classic SQL injection suggests a high exploitation risk, especially if the database credentials have broad privileges. Attackers would need to deliver a crafted input array via an application interface, likely over HTTP. Successful exploitation could result in data exfiltration, alteration, or denial of service. The lack of an official KEV listing does not indicate lower risk, as it simply reflects the absence of a catalog entry.