A vulnerability exists in Oinone Pamirs versions up to 7.2.0. The flaw resides in the RSQLToSQLNodeConnector.makeVariable method of the queryListByWrapper interface, where user‑provided RSQL expressions are converted to raw SQL without proper sanitization, allowing an attacker to inject arbitrary SQL statements. If exploited, this could let the attacker read, modify, or delete data in the underlying database, potentially exposing sensitive information or disrupting application functionality.

The affected product is Oinone Pamirs, available from the vendor Oinone. The vulnerable component is present in all releases up to version 7.2.0. No specific subcomponents or modules are listed beyond the queryListByWrapper interface. Systems running these versions and exposing the RSQL querying functionality are at risk.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is publicly disclosed, with no EPSS data available and not listed in CISA KEV. Exploitation requires remote access to the RSQL endpoint, making it practical for attackers with network reach. The lack of a vendor response further increases risk. Administrators should treat this as a non‑critical but actionable threat that could lead to data compromise if left unpatched.