The vulnerability stems from improper SQL query construction in backend record editing and auto-suggest features. TYPO3's TCA-driven query builder (t3lib_db::exec_SELECTquery) and form handlers (t3lib_TCEforms) are core components that process user input. The advisory specifically mentions TCA 'where' clauses and auto-suggest as attack vectors, implicating these functions. While exact commit diffs are unavailable, historical TYPO3 security practices confirm these components were frequently hardened against SQLi in patches. The medium confidence for AJAX handlers reflects the lack of explicit function names in advisories, but their role in user-input processing aligns with described exploit paths.