EUVD-2026-84999
GHSA-v3xv-f287-j6jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege console user
-
DeliverySend getBotList request with malicious sortDirection
-
ExploitBreak out of ORDER BY via MyBatis ${} interpolation
-
ExecutionInject time-based blind SQL (IF/SLEEP)
-
ImpactExtract database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account on the iFlytek astron-agent console (PR:L) and network access to the getBotList API endpoint. The vulnerable code path is the ORDER BY clause of ChatBotMarketMapper.xml where the |
| Impact | This is a genuine but modest-priority SQL injection. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) - so it is not an unauthenticated internet-wide risk; an attacker needs a valid account on the astron-agent console first. VulDB scored the impact conservatively at VC:L/VI:L/VA:L (base 5.3), but the GitHub source evidence and the vendor's own regression test show the injection is in a MyBatis |
| Exploit ScenarioDerived | An authenticated low-privilege user of the iFlytek astron-agent console sends a getBotList API request with a crafted |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in the console component of iFlytek astron-agent (versions up to and including 1.0.7) lets an authenticated low-privilege user inject arbitrary SQL via the sortDirection parameter of the getBotList API, which is concatenated directly into the ORDER BY clause of ChatBotMarketMapper.xml. Because the vulnerable ORDER BY sink cannot return query results to the caller, exploitation is blind (time- or boolean-based), so an attacker with a valid console account and network access to the endpoint could progressively extract backend data - the independent assessment rates confidentiality impact as high (CVSS:3.1 C:H, PR:L, AV:N) with no integrity or availability effect. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS data was not supplied; the vendor addressed it in release reward-1575 by whitelisting the sort direction.
RemediationAI
Vendor-released patch: upgrade to astron-agent release reward-1575 (or apply commit 6702be70ae802b1048f5fbec91e690e7b71a4165 / PR https://github.com/iflytek/astron-agent/pull/1342), which replaces direct interpolation of sortDirection with a DESC/ASC allow-list via getSafeSortDirection(). If upgrading is not immediately possible, compensating controls should be applied in this order: validate or hard-reject any sortDirection value that is not exactly ASC or DESC at the reverse proxy/WAF in front of the console (effective but can break clients that send lowercase or unexpected tokens, so log and normalize rather than silently 500); restrict network access to the getBotList endpoint to trusted networks and require strong authentication, since a valid low-privilege account is a prerequisite for exploitation (this reduces exposure but does not fix the injection for legitimate users); and run the console backend against a database account with only the privileges it genuinely needs so that blind extraction of other schemas or file/stacked-query abuse is limited (a defense-in-depth measure with no functional side effects but also no guarantee against in-scope data theft). Monitor console access logs for anomalous sortDirection payloads containing commas, SQL functions, comment markers, or conditional delay constructs, and check database logs for unexpected SLEEP/BENCHMARK-style execution, then treat any hit as a credential-compromise investigation trigger. Reference advisories: https://vuldb.com/vuln/408551, https://github.com/iflytek/astron-agent/issues/1329, https://github.com/iflytek/astron-agent/releases/tag/reward-1575.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection arising from MyBatis string substitution rather than parameter binding. In console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml, the ORDER BY clauses for a.create_time and a.update_time interpolate the caller-supplied sortDirection value using MyBatis' ${} syntax, which performs raw text replacement into the SQL statement instead of the safe #{} placeholder used for bind parameters. ORDER BY column/direction tokens generally cannot be bound as parameters, so the correct defense is an allow-list; the upstream fix does exactly this by adding getSafeSortDirection() (normalizing to DESC/ASC) and referencing condition.safeSortDirection in the mapper, with a unit test proving that a payload such as DESC,IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)-- is normalized back to DESC. The affected code lives in the console backend commons module and is reachable through the getBotList market API endpoint; the CPE cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:* reflects that all released versions up to 1.0.7 are in scope. Exploitation is possible remotely (AV:N) by an account with only basic privileges (PR:L per the authoritative assessment), with no user interaction and no special configuration toggle required.
Know when Astron Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated (PR:L) network ORDER BY injection enabling blind time-based extraction of full database contents (C:H); no write path via MyBatis parameter and no availability impact, so I:N/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in iFlytek astron-agent SQLi and SSRF Vulnerabilities
View all 2More in Astron Agent
View allAuthenticated low-privilege tenant users of iFlytek Astron Agent prior to 1.1.2 can run arbitrary Python as root inside
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workfl
Cross-tenant workflow hijacking in iFlytek Astron Agent through 1.1.2 lets an authenticated application on a shared depl
Exploit-DB