An SQL injection vulnerability exists in MixPHP Framework versions 2.0.0 through 2.2.17. The flaw is triggered via a crafted 'on' array passed to the joinOn function in BuildHelper.php. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to limited confidentiality and integrity impacts without affecting availability.