Executive brief
APIJSON is an open-source ORM library that provides a no-code backend API framework. A SQL injection vulnerability in the @having operator allows unauthenticated attackers to bypass table-level access controls and read arbitrary database tables, potentially exposing sensitive customer data, internal records, or operational information.
Technical details
The vulnerability is a SQL injection in the Map-form @having operator that fails to properly sanitize user input before injecting it into SQL queries. An unauthenticated remote attacker can craft a malicious request using the @having parameter to inject arbitrary SQL, bypassing per-table access control mechanisms built into APIJSON. The attack requires no authentication and is network-accessible via the API. An attacker can execute SELECT queries to read data from any database table regardless of configured access restrictions. Patches are expected to be available in versions after 8.1.8.
Affected products
- Tencent APIJSON through 8.1.8
Timeline
- 2026-08-10: disclosed