This vulnerability involves improper neutralization of special elements in SQL commands (CWE-89) within Apache Syncope. An administrator with appropriate entitlements can exploit unsanitized sort parameters to execute arbitrary SQL queries, including stacked queries. The vulnerability affects multiple version ranges of Apache Syncope, specifically from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The vendor has addressed this issue in versions 4.0.7 and 4.1.2. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary SQL commands on the backend database, potentially leading to full compromise of the database confidentiality, integrity, and availability. This can result in unauthorized data access, data modification, or denial of service.

Users should upgrade affected Apache Syncope instances to versions 4.0.7 or 4.1.2, which contain fixes for this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating these versions fix the issue.