A critical SQL injection vulnerability in Hypequery versions prior to 2.0.2 exposes systems to unauthorized data access and manipulation.

The vulnerability exists in the escapeValue function within the core utilities, where backslashes are not properly handled before single quotes. This allows an unauthenticated attacker to inject malicious SQL code through manipulated query parameters.

The CVSS score of 9.8 reflects the high severity of this flaw, as it permits full database compromise without authentication. Successful exploitation may lead to complete data exfiltration, unauthorized modification of sensitive information, or the destruction of database integrity, causing significant operational and reputational damage.

Immediate Action: Upgrade Hypequery to version 2.0.2 or later immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review database query logs for unusual syntax, such as unexpected backslashes or SQL keywords originating from application-level parameters.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection patterns in incoming requests.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this SQL injection vulnerability, administrators should prioritize patching to version 2.0.2 across all environments. Failure to update leaves the backend ClickHouse database exposed to remote command execution, necessitating immediate action to mitigate the risk of data compromise.