BAQ - Possible SQL Injection

Kinetic ERP
1

So, apparently I have a calculated field in a BAQ that was OK in 2025.1, but it’s failing in our PILOT 2025.2 system. When I analyze the query, it’s giving a “Possible SQL Injection” error.

I’ve got a BAQ that’s accumulating quote data, and I’m linking to the Memo table to get memos from both the Header and the Detail. Rather than having a “Header Memo” field in the dashboard along with a “Detail Memo” field, I am combining them into one field via a calculated field. What I’m doing is if both fields have data in them, I WAS listing them both with the header prefixed with “(Header)”, and the line prefixed with “—(Line)”, and the memo description concatenated. The Calculated field was as follows:

(case when  Memo.MemoDesc > '' and MemoDtl.MemoDesc > '' 
        and Memo.MemoDesc <> MemoDtl.MemoDesc  then  
    '(Header) ' + Memo.MemoDesc + '  ---(Line) ' + MemoDtl.MemoDesc
 else 
    (case when  Memo.MemoDesc > ''  then  
        Memo.MemoDesc 
     else  
        MemoDtl.MemoDesc end) end)

The three dashes that were hardcoded in the calculated field was what was causing the “Possible SQL Injection” error (technically, two dashes would’ve caused the error). It was there just for readability, so the result would look something like this:

   (Header) Header memo description here ---(Line) Detail memo here.

I just removed the three dashes in the calculated field, and the error went away.

Figured I’d share here in case someone has the same issue.

2 Likes
2

support told us 2025.2.5 fixes this error; will be placed on Pilot 10/25 or so.
We opted to clean up calculated fields in our BAQs; ultimately removing embedded semicolons and unnecessary () seemed to fix the BAQs in Pilot.
Created solutions to upload to Live just in case 2025.2.5 does not fix.

1 Like
3

We were told the same regarding patch 5 so :crossed_fingers: we have a calculated field that is searching for semi colons to distinguish if a field has one or multiple email addresses in.

Also have a customer that has part numbers with ‘Drop’ in the middle with space (yes spaces in part numbers) that is also affected.

1 Like
4

image
image1200×628 84.6 KB

3 Likes
5

If Bobby really knew what he was doing, he should have been named

Robert'); Update TestScores Set Score=100 where FirstName = 'Robert';
2 Likes
6

"Robert'); DROP TABLE Taxpayers;--"
"Richard'); DROP TABLE Bureaucracy;--"
"William'); DROP TABLE DMV_Lines;--"
"Sandra'); DROP TABLE Meetings;--"
"Kimberly'); DROP TABLE Monday_Morning_Emails;--"

Need more kids