A manipulation of the fallBackSql argument in the QueryServiceSMOImpl.fallBack method exposes a SQL injection flaw. An attacker can inject arbitrary SQL statements, potentially reading, modifying, or deleting data from the underlying database, and if privilege escalation is possible, may gain full database control. The weakness involves improper handling of user‑supplied input and is reflected in CWE‑74 and CWE‑89. The described vulnerability demonstrates that the application accepts unsanitized user input and passes it directly to a SQL statement without protection.

The issue affects the java110 MicroCommunity platform, specifically versions up to and including 2.0. The vulnerable code resides in BusinessApi.java’s fallBack API endpoint within the QueryServiceSMOImpl component.

The CVSS base score is 6.9, indicating a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote; the exploitable endpoint is publicly reachable, and the exploit code is already publicly available. No special conditions or privileged access are required, so an unauthenticated user could trigger the injection by sending crafted requests to the API.