The DIRAC PilotManager service improperly handles input parameters by passing them directly to the database layer without escaping, leading to SQL injection vulnerabilities. Although multiple SQL statements separated by semicolons are not accepted, crafted inputs can still alter or disclose database entries. The access control for PilotManager functions is insufficient, requiring only authentication but no further authorization, allowing any authenticated user to manage pilot jobs. The vulnerability is addressed by changing SQL statements to use parameter substitution and enforcing appropriate access rules. Affected versions include DIRAC >=6 and <8.0.79, and >=9.1.0 and <9.1.10.

An attacker with authenticated access can exploit SQL injection to read or modify database entries related to pilot jobs. The lack of proper access control means any authenticated user can perform these actions, potentially leading to unauthorized data disclosure and modification. The vulnerability does not allow denial of service or privilege escalation beyond the authenticated user level but compromises data integrity and confidentiality within the PilotManager service.

A fix is available in DIRAC versions 8.0.79, 9.0.22, and 9.1.10. Users should upgrade to one of these patched versions to address the SQL injection and access control issues. The patch implements proper parameter substitution in SQL queries and enforces stricter access control rules for PilotManager functions.