The vulnerability lies in Tianji's getDateQuery() function, which builds raw SQL queries by directly inserting a timezone value supplied via request data or the timezone HTTP header. Because of the lack of parameter binding, an attacker can inject arbitrary SQL statements into the analytics queries, potentially retrieving sensitive information or altering database contents. The affected code enables any authenticated workspace member—including read‑only viewers—to trigger these queries, allowing attackers with a legitimate account to access the database through the web interface.

The weakness affects the open‑source Tianji analytics platform provided by msgbyte. Versions prior to 1.31.29 are impacted; the issue was addressed in release v1.31.29. Users who have authenticated workspace members, even those with read‑only permissions, may invoke the vulnerable analytics endpoint and thereby reach the underlying database.

The CVSS score of 8.8 signals a high severity, yet the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to obtain an authenticated workspace membership and send a crafted request that supplies a malicious timezone value, either via form data or HTTP header. Successful exploitation could lead to disclosure or modification of credentials, API keys, and tenant data, or degrade service availability.