The datapoint export API in OpenRemote Manager builds PostgreSQL crosstab export queries by concatenating asset display names into raw SQL statements. Authenticated users with asset creation or renaming permissions can inject SQL via specially crafted asset names. The injection exploits incomplete escaping of double quotes and fixed dollar-quote delimiters in SQL identifiers and category queries. This allows attacker-controlled SQL appended to the COPY TO STDOUT query, streaming query results back in the CSV export. The vulnerability enables database data exfiltration through the application API without requiring direct database or filesystem access.

A remote authenticated attacker with asset read/write and export permissions can execute arbitrary SQL queries within the context of the application database role. This leads to unauthorized data disclosure by exfiltrating database contents via the exported CSV file. In multi-tenant environments, this may expose data belonging to other tenants, increasing the risk of sensitive information leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended fix is to avoid embedding user-controlled asset names directly into executable SQL. This includes generating deterministic internal column aliases instead of using asset names as SQL identifiers, applying proper database-aware quoting for dynamic identifiers, and avoiding fixed dollar-quote delimiters around user-influenced strings. Until an official fix is available, restrict asset creation and renaming permissions to trusted users only and avoid exporting datapoints in crosstab format for assets with untrusted names.