The front‑end interface /superdiamond/preview/{projectCode}/{module}/{type} of super‑diamond-server up to version 1.3.3 allows arbitrary SQL injection. The module parameter is concatenated directly into an SQL IN clause via StringUtils.split() and string concatenation without parameterization or binding, permitting an attacker to inject malicious SQL statements. When executed, this flaw can lead to data exfiltration, modification, or deletion within the underlying database, compromising confidentiality, integrity, and availability of application data.

Any deployment of super‑diamond-server version 1.3.3 or earlier is vulnerable. The issue exists in the /superdiamond/preview endpoint that accepts projectCode, module, and type values over HTTP. The vulnerability affects the backend database accessed by the server and is not limited to a specific environment; any host running a vulnerable version is potentially exposed.

The vulnerability has no publicly disclosed EPSS score, but due to its nature—direct injection via a publicly accessible HTTP endpoint—the likelihood of exploitation is significant for exposed services. The flaw does not require advanced privileges and can be triggered from any client that can reach the endpoint, making the attack vector remote over the network. As of now, the flaw is not listed in CISA’s KEV catalog, but its high impact warrants urgent attention.