A critical SQL injection vulnerability in the Erupt framework could allow unauthenticated remote attackers to execute arbitrary database queries.

The flaw resides in the geneEruptHqlOrderBy function within the EruptJpaUtils.java file. An unauthenticated attacker can supply a malicious sort.field argument to inject SQL commands into the Hibernate layer.

Successful exploitation of this vulnerability can lead to unauthorized data access, modification, or destruction within the backend database. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially resulting in severe reputational damage and regulatory non-compliance if sensitive information is exfiltrated.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected application interface and monitor for suspicious SQL syntax in application logs.

Proactive Monitoring: Implement database activity monitoring to detect unusual query patterns, specifically those containing unexpected SQL keywords or structural changes initiated through the sort.field parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the researcher write-up provided via the referenced Feishu technical advisory.

Given the availability of public exploit details and the lack of a vendor-provided patch, this vulnerability presents an immediate and elevated risk. Security teams should prioritize isolating the affected component from public-facing networks and implement strict WAF filtering to mitigate the threat until a secure version is released.