Executive brief
Oinone Pamirs, an AI-driven low-code development framework, contains a security flaw in its data querying interface. An unauthorized attacker can send specially crafted requests to the system to execute arbitrary database commands. This could lead to the unauthorized viewing, modification, or deletion of sensitive business data, potentially granting the attacker full control over the underlying database.
Technical details
A SQL injection vulnerability exists in the Oinone Pamirs framework (up to version 7.2.0) within the RSQLToSQLNodeConnector.makeVariable function of the queryListByWrapper interface. The root cause is the improper neutralization of special characters; specifically, the framework performs direct string concatenation of single quotes when processing RSQL strings without adequate escaping. An unauthenticated remote attacker can use double-quote syntax within an RSQL query to escape string boundaries and inject malicious SQL fragments. This can result in unauthorized data exfiltration, modification, or the execution of administrative database commands (SQL-shell level privileges). As of the advisory date, the vendor has not responded to disclosure attempts, and no official patch is available.
Affected products
- Oinone Pamirs up to 7.2.0
Timeline
- 2026-04-22: disclosed: Public disclosure of vulnerability and PoC on GitHub
- 2026-05-17: advisory: NVD/VulDB advisory published