Description

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. The APIJSONORM library's AbstractSQLConfig.java applies the per-role allow-list check only on the String form of @having but not on the Map form, allowing a guest user to inject raw SQL fragments and read tables that are configured with get:[] (empty, meaning no role can read them).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:28.973Z",
  "pubdate": "2026-08-10T11:17:28.973Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in Tencent APIJSON through version 8.1.8, affecting the APIJSONORM library specifically within AbstractSQLConfig.java. This security flaw enables remote attackers to completely bypass per-table access control mechanisms and read arbitrary database tables.\nThe vulnerability stems from inconsistent input validation applied to the Map-form versus the String-form of the @having operator. While the application correctly enforces per-role allow-list checks on the String form, it fails to apply identical restrictions to the Map form. Consequently, unauthenticated guest users can supply specially crafted Map-form payloads containing raw SQL fragments.\nThe impact of this vulnerability is severe, allowing unauthorized data exfiltration from database tables that are strictly configured with get:[] (empty arrays), signifying that no role should possess read access. Exploitation requires network access to the API endpoint and the ability to submit structured API requests leveraging the vulnerable @having operator, granting guest-level attackers unauthorized visibility into sensitive backend database structures and records.",
  "technicalDetails": "The root cause of the vulnerability resides in the AbstractSQLConfig.java component within the APIJSONORM library. During query configuration and execution, the application enforces security policies—specifically per-role allow-list checks—to restrict data access based on defined table privileges. However, the security enforcement logic suffers from an input handling discrepancy regarding the @having operator.\nWhen a query is processed using the String form of the @having operator, the APIJSONORM library evaluates the input against the configured per-role allow-list. Conversely, when the @having operator is supplied in a Map form, the validation routines fail to execute the corresponding security checks. This inconsistency leaves a validation gap that permits untrusted input to bypass serialization and validation boundaries.\nThe attack flow proceeds as follows: An unauthenticated remote attacker identifies an exposed Tencent APIJSON endpoint utilizing vulnerable versions through 8.1.8. The attacker constructs a malicious API request containing the Map-form @having operator. Because the AbstractSQLConfig.java component does not validate the Map form against the role allow-list, the application interprets the injected structure as a valid database constraint.\nThe attacker embeds raw SQL fragments within the Map-form @having parameter. These injected SQL fragments are subsequently concatenated or interpreted directly by the underlying database engine during query execution. This behavior effectively neutralizes the table-level security model configured via access control policies.\nAs a result of this payload behavior, the remote attacker can successfully query and read arbitrary database tables, including those explicitly secured with restrictive access controls such as get:[]. This allows unauthorized retrieval of sensitive records without requiring authentication, elevated privileges, or prior interaction with the administrative interface."
}