The vulnerability stems from unparameterized SQL queries using the eventTime parameter. The primary vulnerable function would be the Data Access Object (DAO) method that handled policy queries with eventTime parameters using string concatenation, as indicated by the patch note about replacing native queries with JPA named queries. The REST controller endpoint that accepts the eventTime parameter and passes it to the DAO would appear in call stacks during exploitation. While we don't have exact patch diffs, the CVE description explicitly identifies both the vulnerable parameter (eventTime) and the mitigation strategy (JPA named queries), strongly indicating database access functions handling this parameter were vulnerable.