Aix Db
Monthly
Aix-DB 1.2.4 ships a ChatBI 'common agent' that exposes the deepagents execute tool without any gating, letting any authenticated non-admin user escalate from chat input to host-level operating system command execution. The two documented paths are crafted text sent to the POST /dify/get_answer endpoint and uploaded documents containing malicious text that the agent processes; successful exploitation exposes datasource credentials and model API keys held by the application. Publicly available exploit code exists, and the issue carries a CVSS 4.0 base score of 8.7, though exploitation is bounded by the need for a valid low-privileged account on a deployment that has the ChatBI common agent enabled.
Unauthenticated SQL data exfiltration in Aix-DB versions up to and including 1.2.4 allows attackers on adjacent networks to issue arbitrary SELECT queries against the application's database through the /llm/process_llm_out endpoint, which omits the token validation enforced on every other application route. The flaw was disclosed by CERT-PL and currently has no public exploit identified at time of analysis, but the CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VC:H) reflects trivial exploitation once an attacker reaches the deployment network. No vendor-released patch identified at time of analysis.
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. No public exploit has been identified and there is no CISA KEV listing, but the attack is trivially reproducible given the unsanitized rendering pipeline confirmed by source code evidence.
SQL injection in apconw Aix-DB through the terminology_retriever.py module allows local attackers to manipulate the Description argument and execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. Affected versions include Aix-DB up to 1.2.3.
Aix-DB 1.2.4 ships a ChatBI 'common agent' that exposes the deepagents execute tool without any gating, letting any authenticated non-admin user escalate from chat input to host-level operating system command execution. The two documented paths are crafted text sent to the POST /dify/get_answer endpoint and uploaded documents containing malicious text that the agent processes; successful exploitation exposes datasource credentials and model API keys held by the application. Publicly available exploit code exists, and the issue carries a CVSS 4.0 base score of 8.7, though exploitation is bounded by the need for a valid low-privileged account on a deployment that has the ChatBI common agent enabled.
Unauthenticated SQL data exfiltration in Aix-DB versions up to and including 1.2.4 allows attackers on adjacent networks to issue arbitrary SELECT queries against the application's database through the /llm/process_llm_out endpoint, which omits the token validation enforced on every other application route. The flaw was disclosed by CERT-PL and currently has no public exploit identified at time of analysis, but the CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VC:H) reflects trivial exploitation once an attacker reaches the deployment network. No vendor-released patch identified at time of analysis.
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. No public exploit has been identified and there is no CISA KEV listing, but the attack is trivially reproducible given the unsanitized rendering pipeline confirmed by source code evidence.
SQL injection in apconw Aix-DB through the terminology_retriever.py module allows local attackers to manipulate the Description argument and execute arbitrary SQL commands. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. Affected versions include Aix-DB up to 1.2.3.