The SimplePdo helper methods construct SQL by directly inserting an unquoted table name and data array keys into the query. This omission allows an attacker to embed SQL fragments through crafted array keys, giving full control over the executed statement. The vulnerability enables arbitrary SQL execution, potentially exposing, altering, or deleting application data and compromising confidentiality, integrity, and availability.

Affected is the Flight PHP micro‑framework core library. All releases before version 3.18.1 contain the flaw, as the denial of safe identifier quoting is present in insert, update, and delete helpers.

The CVSS score of 8.8 indicates high severity, and the EPSS score is unavailable, which does not lower the risk assessment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely through web input where user data is passed directly to the helper methods; an attacker controlling array keys can trigger the injection. The condition for exploitation is that the application forwards user‑controlled data shapes to these helpers, a documented pattern in typical Flight usage. When present, exploitation could lead to any authority level the application possesses.