An authenticated SQL injection vulnerability in Daptin before version 0.11.4 allows attackers to execute arbitrary database queries and compromise data integrity.

This is an SQL injection vulnerability (CWE-89) affecting the aggregate endpoint, where query parameters are passed without validation to a raw SQL expression builder. The attacker authentication level is low, requiring any valid user session.

A successful exploit of this vulnerability could allow malicious actors to extract sensitive data, modify database contents, or disrupt service availability. Given the CVSS score of 8.3, the issue represents a high severity risk that directly threatens the confidentiality and integrity of core business applications.

Immediate Action: Update Daptin to version 0.11.4 or later immediately.

Proactive Monitoring: Monitor application access logs for unusual traffic patterns and inspect database query execution times for anomalous behavior.

Compensating Controls: Deploy a Web Application Firewall to inspect and filter malicious payloads targeting the aggregate API endpoint if immediate patching is not feasible.

Public Exploit Available: false

Organizations utilizing Daptin must apply the official vendor security update to version 0.11.4 without delay. Prompt remediation is critical to prevent authenticated attackers from leveraging SQL injection to compromise the underlying database systems.