Technical impact
The vulnerability is an instance of Improper Neutralization of Special Elements used in an SQL Command (CWE-89). An unauthenticated attacker can craft a request to the Manager OpenAPI audit alert rule list endpoint, tampering with the ORDER BY clause and causing the backend database to execute arbitrary SQL. This can allow the attacker to read, modify or delete data stored in the Manager database, potentially exposing sensitive information or disrupting service.
Affected Systems
Apache Software Foundation products Apache InLong are affected. The Manager component in versions 2.0.0 through 2.3.x (prior to 2.4.0) is vulnerable. Users should check for the presence of the vulnerability in any deployed InLong instance within this version range.
Risk and Exploitability
The vulnerability allows unauthenticated SQL injection, which is high risk because the attacker can reach the database without credentials. The CVSS score is 9.8, the EPSS score is <1%, and the issue is not listed in the CISA KEV catalog; the lack of authentication requirement means the attack vector is likely HTTP requests to the exposed OpenAPI endpoint. In environments where the InLong Manager is reachable from the network, an attacker could easily exploit the flaw to compromise database integrity and confidentiality.
