Executive brief
iFlytek's astron-agent is an enterprise workflow automation platform that uses an API to retrieve bot lists from a backend database. A flaw in the getBotList endpoint allows attackers to inject malicious SQL commands by manipulating the sort direction parameter, potentially exposing sensitive database records or enabling unauthorized data modification. The vulnerability can be exploited remotely without authentication.
Technical details
SQL injection vulnerability in the getBotList API endpoint (ChatBotMarketMapper.xml) where the sortDirection parameter is not properly sanitized before inclusion in SQL queries. An attacker can craft a malicious sortDirection value to break out of the intended SQL context and inject arbitrary SQL commands, gaining read/write access to the backend database. A fix is available in version reward-1575 (commit 6702be70ae802b1048f5fbec91e690e7b71a4165).
Affected products
- iFlytek astron-agent up to 1.0.7
Timeline
- 2026-09-23: disclosed