This vulnerability in Oinone Pamirs (up to version 7.2.0) involves improper input handling in the RSQLToSQLNodeConnector.makeVariable function of the queryListByWrapper interface, resulting in SQL injection. An attacker can remotely exploit this flaw without authentication or user interaction, potentially manipulating backend database queries. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector and low complexity. The vendor has not provided any fix or advisory, and no patch links are available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited complexity and the absence of known active exploitation in the wild. The vulnerability does not require privileges or user interaction, increasing its risk profile.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users should monitor vendor communications for updates. In the meantime, consider implementing application-level input validation and restricting database permissions to minimize potential impact. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.