This vulnerability in Oinone Pamirs (up to version 7.2.0) involves SQL injection in the RSQLToSQLNodeConnector.makeVariable function of the queryListByWrapper interface. An attacker can remotely manipulate inputs to inject SQL commands, compromising the database's integrity or confidentiality. The issue has been publicly disclosed without vendor response or available patch. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized data disclosure, modification, or deletion. Given the medium CVSS score and low impact metrics, the overall impact is moderate. No confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying workarounds such as input validation or query parameterization if possible. Monitor for any updates from the vendor or trusted security sources for official patches or mitigations.