A failure in the entity engine’s generic performFind service lets a remote, unauthenticated attacker submit a specially crafted ignore‑case query, causing the framework to inline a backslash‑terminated value into the generated SQL. Because MySQL and MariaDB honor backslashes as escape characters, the value can break out of the string literal and turn a selective WHERE clause into a tautology, thereby exposing arbitrary rows from the targeted entity. This flaw does not affect Derby or PostgreSQL databases, which do not treat backslashes as escapes in this context.

Apache OFBiz 24.09 builds prior to 24.09.08 running on MySQL or MariaDB back‑ends are affected. Versions 24.09.08 through the latest release contain the fix. The default Derby and PostgreSQL data sources are not vulnerable.

The vulnerability is exploitable by any user capable of invoking the performFind service. No authentication is required, and the required payload can be transmitted over the public network to the OFBiz application. Because the exploit simply turns a conditional query into a tautology, it enables wide‑open data disclosure but does not provide code execution. The EPSS score is not reported, and the vulnerability is not included in the CISA KEV catalog, but the lack of mitigation means a high likelihood of exploitation against exposed OFBiz instances. The impact is severe for confidentiality, with moderate implications for integrity and availability due to potential data leakage.