The TDuckCloud tduck-platform contains a SQL injection vulnerability in the PaginationInnerInterceptor component that poses a risk of unauthorized database interaction for authenticated users.

This is a SQL injection vulnerability (CWE-89) triggered by improper handling of the orders[0].column argument within the PaginationInnerInterceptor.concatOrderBy function. The vulnerability requires the attacker to possess low-level privileges to interact with the affected API endpoint.

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. While the CVSS score of 6.3 indicates a medium severity, the ability to manipulate database queries directly impacts the integrity and confidentiality of the application's data layer. Organizations relying on this platform for sensitive survey or form data are at particular risk of data breaches.

Immediate Action: Apply the vendor-provided patch by incorporating commit ea7f0fae7cb0fd998a3284c11addce689350cd69 into your deployment or updating to a version where this fix is integrated.

Proactive Monitoring: Review database audit logs for unusual query patterns, specifically those involving unexpected SQL syntax or attempts to access administrative tables, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, particularly focusing on the parameters used for pagination and sorting.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided vulnerability references.

Given the availability of a public proof-of-concept and the nature of SQL injection, this vulnerability should be prioritized for remediation in the current patch cycle. Administrators must ensure the identified patch is applied to all affected instances of the tduck-platform to prevent potential data compromise. Failure to address this flaw could allow attackers to bypass standard application logic and gain unauthorized control over the database tier.