The DHIS2 core application contains a SQL injection vulnerability (CWE-89) in the SqlView API endpoint. The issue arises from improper neutralization of special elements in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with SqlView access can craft malicious input that is executed by PostgreSQL, with error messages reflecting the output, enabling extraction of arbitrary database content via error-based SQL injection. Affected versions include 2.37, 2.38, 2.39, and versions in the 2.40.x, 2.41.x, 2.42.x, and 2.43.x series prior to their respective patched releases. Fixed versions include 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, and versions after PR #24162 in the 2.44 development branch.

Successful exploitation allows an authenticated user with access to a SqlView to perform error-based SQL injection, potentially extracting arbitrary sensitive data from the backend database. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). This could lead to unauthorized data disclosure and manipulation within the DHIS2 system.

Patched versions addressing this vulnerability are available: 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, and versions after PR #24162 in the 2.44 development branch. Users should upgrade to these versions or later to remediate the issue. No vendor advisory content contradicts this; therefore, upgrading is the recommended remediation.