The vulnerability resides in Dromara MaxKey’s StrUtils.checkSqlInjection method, where a manipulated filtersfields argument can cause arbitrary SQL to be injected into database queries. The flaw is exploitable remotely, as the affected code is reachable over the network. The description confirms that the vendor has not responded to the disclosure. No further evidence is provided regarding specific data that could be accessed or altered; the impact is limited to the information available through the compromised database.

Versions of Dromara MaxKey up to and including 3.5.13 are affected. The flaw resides in the StrUtils.java component that processes user-supplied filter fields. Administrators should verify whether their deployments run a vulnerable release and plan to upgrade to a fixed version when one becomes available.

The CVSS base score of 5.3 indicates moderate severity. An exploit is publicly available and can be triggered remotely, but no documented real-world attacks have been cited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Organizations running vulnerable versions should consider remediation to avoid potential exploitation.