Technical impact
Improper neutralization of special elements in SQL commands allows an attacker to inject malicious SQL statements through the dbName, tableName, schemaName, and username parameters. This flaw can result in the execution of unintended queries, leading to unauthorized data disclosure, modification, or deletion. The impact spans confidentiality, integrity, and availability of the underlying database.
Affected Systems
Apache InLong versions 2.0.0 up through 2.3.x are affected. The vendor is Apache Software Foundation and the product is Apache InLong. All installations using any of the vulnerable releases should be considered at risk.
Risk and Exploitability
The vulnerability is not listed in CISA KEV and the EPSS score is <1%, while its CVSS score of 9.8 denotes critical severity. Nevertheless, the ability to inject arbitrary SQL via exposed parameters suggests a high-risk scenario, especially if the service is reachable over the network. The attack vector is likely remote through any API or web interface that accepts the vulnerable parameters. The potential for data loss or tampering remains significant even without known exploitation reports.
