Erupt SQL Injection Vulnerability in MCP Tool Interface

A SQL injection vulnerability has been identified in Erupt versions through 1.13.3, specifically within the MCP Tool Interface component. The issue arises in the EruptDataQuery function, where user-controlled Hibernate Query Language (HQL) input is executed without any validation or sanitization. This flaw allows authenticated attackers with OpenAPI credentials to execute arbitrary database queries, potentially leading to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability allows for arbitrary execution of HQL queries, which could be used to read or modify any accessible database entities. This could result in unauthorized access to sensitive data or manipulation of database records.