A flaw in the MixPHP Framework 2.x allows an attacker to inject arbitrary SQL statements through a specially crafted "on" array supplied to the joinOn function in BuildHelper.php. This injection can be used to read, modify, or delete data in the underlying database, compromising confidentiality, integrity, and potentially availability of the application. The weakness is a classic SQL injection vulnerability (CWE-89).

The vulnerability affects all releases of MixPHP Framework from version 2.0 up to and including 2.2.17. No other products or vendors are listed as affected.

Because the flaw is triggered by a constructed input array, the exploitation requires the ability to influence the query construction, typically through the application’s normal data‑entry paths. No specific authentication requirements are stated, implying that the risk applies to any user who can supply the "on" array. The CVSS score of 6.5 indicates medium severity and, combined with the fact that the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, the risk remains significant.