Tencent APIJSON contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to bypass access controls and perform unauthorized database operations.

The vulnerability exists in the handling of the Map-form @having operator, which fails to properly neutralize special elements used in SQL commands. This flaw allows unauthenticated remote attackers to execute arbitrary SQL queries against the underlying database.

Successful exploitation of this vulnerability permits unauthorized access to sensitive database information, potentially leading to complete data exfiltration or integrity loss. Given the CVSS score of 9.8, this represents a critical risk to data confidentiality and system availability. Organizations relying on APIJSON for database abstraction are at high risk of compromise if this flaw remains unpatched.

Immediate Action: Review the Tencent APIJSON GitHub repository for the latest security release and apply the update to version 8.1.9 or later as soon as it becomes available.

Proactive Monitoring: Monitor database query logs for unusual patterns, specifically looking for the use of the @having operator in API requests that appear to be attempts at SQL manipulation.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious SQL injection payloads targeting the APIJSON endpoints.

Public Exploit Available: No confirmed public exploit available.

This vulnerability presents a severe risk due to the potential for unauthenticated database access. Administrators must prioritize the application of the vendor patch immediately upon release and ensure that all affected instances are updated to the secure version to prevent unauthorized data access.