This vulnerability in aaPanel BaoTa up to version 11.8.0 involves improper sanitization of the log_type argument in the getData function within /www/server/panel/class/data.py. An attacker can remotely exploit this to inject SQL commands, potentially compromising the database. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity) with network attack vector, low complexity, and no user interaction required. Public exploit code exists, but the vendor has not issued any advisory or patch.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. However, the vulnerability requires high privileges to exploit and has low impact on confidentiality, integrity, and availability, resulting in a medium severity rating.

No official patch or vendor advisory is currently available. Users should monitor the vendor's communications for updates. Until a fix is released, restricting access to the affected function and applying web application firewall rules to detect and block SQL injection attempts targeting the log_type parameter may reduce risk.