Discourse's Data Explorer plugin contains a SQL injection vulnerability that exploits an interaction between two features that each appear safe in isolation. The plugin was designed to let administrators share SQL queries with non-technical users through a parameterized query system — a design choice that creates a false sense of security because parameter substitution was assumed to prevent injection. What makes this exploitable is recursive parameter interpolation: parameter values can reference other parameters, and those references get processed before the SQL is executed. An attacker can craft a parameter value that injects a parameter declaration into a SQL comment; when the SQL engine parses that comment, it extracts and executes the injected parameter as a separate statement, bypassing the intended parameter substitution protection.
The read-only transaction constraint limits the impact to data exfiltration rather than modification — any table in the database can be read, but no data can be altered. This constraint almost certainly saved organizations from worse damage, but it represents a fundamental mismatch in threat modeling: the defense was designed against data destruction, not data theft. Organizations that trusted Data Explorer as a safe analytics tool for business users had already implicitly accepted that those users could read the database — this vulnerability simply revealed that the blast radius extended to every table, including those with no legitimate business reason for access.
The access vector is broader than typical injection flaws. The vulnerability is exploitable by any non-staff member of a group that an administrator has shared a Data Explorer query with. This is not an account compromise scenario — it's the intended user population of the feature. Organizations using Data Explorer for self-service analytics should treat this as a complete confidentiality compromise of their entire database, not a narrow privilege escalation.
The fix addresses recursive parameter interpolation, likely by scoping parameter values to prevent nested references. Organizations running Data Explorer should upgrade immediately regardless of whether they believe their shared users are trustworthy — the vulnerability exists in the feature design, not in a specific misconfiguration.